Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-05-2024 15:54

General

  • Target

    Infected.exe

  • Size

    63KB

  • MD5

    ad7b88bdcbeb87873c4fa8c164fd91bb

  • SHA1

    4a248ffe2f4bd1d9570421f1aa892f9b2c69b0bf

  • SHA256

    6a307f1adf1b502d218dca101b9c9731fb44ffda5a4a2eb0de5c5120b380386b

  • SHA512

    2e7904e3a40be399af2d883c1a2982a23c67990597a77df83dfe1fd8dd05e5de918cb6573bbdb3261131f8b88163c82763d72758b644399d1e894426c1417c0e

  • SSDEEP

    768:jnuguX1wbgyX78dIC8A+XkuazcBRL5JTk1+T4KSBGHmDbD/ph0oXN3p7JZuwSuEV:rvCCPTDdSJYUbdh9pp7JsuEdpqKmY7

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

193.161.193.99:50291

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Infected.exe
    "C:\Users\Admin\AppData\Local\Temp\Infected.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:5380
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:68
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:5064
        • C:\Windows\system32\netsh.exe
          netsh wlan show profile
          3⤵
            PID:4600
          • C:\Windows\system32\findstr.exe
            findstr All
            3⤵
              PID:5988
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5124
            • C:\Windows\system32\chcp.com
              chcp 65001
              3⤵
                PID:4532
              • C:\Windows\system32\netsh.exe
                netsh wlan show networks mode=bssid
                3⤵
                  PID:3460

            Network

            MITRE ATT&CK Matrix ATT&CK v13

            Defense Evasion

            Subvert Trust Controls

            1
            T1553

            Install Root Certificate

            1
            T1553.004

            Modify Registry

            1
            T1112

            Credential Access

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            1
            T1012

            System Information Discovery

            1
            T1082

            Collection

            Data from Local System

            1
            T1005

            Email Collection

            1
            T1114

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\64a445384ed8259e6ef178a00d59628a\Admin@RHATQEDQ_en-US\Browsers\Mozilla\Firefox\Bookmarks.txt
              Filesize

              105B

              MD5

              2e9d094dda5cdc3ce6519f75943a4ff4

              SHA1

              5d989b4ac8b699781681fe75ed9ef98191a5096c

              SHA256

              c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

              SHA512

              d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

            • C:\Users\Admin\AppData\Local\64a445384ed8259e6ef178a00d59628a\Admin@RHATQEDQ_en-US\System\Process.txt
              Filesize

              4KB

              MD5

              cd9981db6f1fa558813787674ebf2eac

              SHA1

              9dd84159d3bc324796331139a84cb0fdce25f08a

              SHA256

              269b6c0bd30401829ab9cefcea33e203a36da44cdc54b2614eb4f8f65239aa9c

              SHA512

              a1bd9b26de1aa3a90f65e62908c29acc832f1fcb983e1971567811686fcea2724b8fed2874131b49cb42678f16451c4edd370bda61cdbe46aeb154371a254121

            • memory/5380-5-0x000000001CBA0000-0x000000001CBBE000-memory.dmp
              Filesize

              120KB

            • memory/5380-11-0x00007FF990900000-0x00007FF9913C1000-memory.dmp
              Filesize

              10.8MB

            • memory/5380-4-0x000000001CB70000-0x000000001CBA4000-memory.dmp
              Filesize

              208KB

            • memory/5380-1-0x00007FF990903000-0x00007FF990905000-memory.dmp
              Filesize

              8KB

            • memory/5380-6-0x00007FF990903000-0x00007FF990905000-memory.dmp
              Filesize

              8KB

            • memory/5380-7-0x00007FF990900000-0x00007FF9913C1000-memory.dmp
              Filesize

              10.8MB

            • memory/5380-8-0x000000001CCA0000-0x000000001CCD2000-memory.dmp
              Filesize

              200KB

            • memory/5380-9-0x00007FF990900000-0x00007FF9913C1000-memory.dmp
              Filesize

              10.8MB

            • memory/5380-10-0x00007FF990900000-0x00007FF9913C1000-memory.dmp
              Filesize

              10.8MB

            • memory/5380-3-0x000000001CBF0000-0x000000001CC66000-memory.dmp
              Filesize

              472KB

            • memory/5380-12-0x0000000000970000-0x000000000098C000-memory.dmp
              Filesize

              112KB

            • memory/5380-13-0x000000001DCD0000-0x000000001DE58000-memory.dmp
              Filesize

              1.5MB

            • memory/5380-18-0x0000000000A00000-0x0000000000A0A000-memory.dmp
              Filesize

              40KB

            • memory/5380-2-0x00007FF990900000-0x00007FF9913C1000-memory.dmp
              Filesize

              10.8MB

            • memory/5380-151-0x00007FF990900000-0x00007FF9913C1000-memory.dmp
              Filesize

              10.8MB

            • memory/5380-159-0x00007FF990900000-0x00007FF9913C1000-memory.dmp
              Filesize

              10.8MB

            • memory/5380-164-0x000000001C630000-0x000000001C6AA000-memory.dmp
              Filesize

              488KB

            • memory/5380-0-0x0000000000220000-0x0000000000236000-memory.dmp
              Filesize

              88KB

            • memory/5380-199-0x00000000007F0000-0x000000000080C000-memory.dmp
              Filesize

              112KB