asyncrat | e85427f2aebd5fbc58019d97020a5bd091e1c2a100fa9e495300fbb0ed4519d7

General

Target
dad9dc836645d3a062a5babbd4eaa8d0_NeikiAnalytics.exe
Size 693KB
Sample240516-ml969sgh67
SHA256 e85427f2aebd5fbc58019d97020a5bd091e1c2a100fa9e495300fbb0ed4519d7
MD5 dad9dc836645d3a062a5babbd4eaa8d0
SHA1 194585dee5d050836b4724efc8c5c36bbe4ab805
SHA512 f9915e367bc8c093cee397e4910471113fece9e5a5aab9329b3b25425f89cd896be8483175a2b13bef34bad8c02dfe15a82dcd800cf54e0dd3bb1f5e50b3504f
SSDEEP 6144:zIPnq+ff9J6oiGYdUnU+Ztr3uOXw5mbkYjF:zonq+ff9J6oiGgUnU+ZtbuOAQwYjF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat stormkitty default persistence rat stealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/1092-4-0x0000000000400000-0x0000000000432000-memory.dmp	family_stormkitty

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\""	dad9dc836645d3a062a5babbd4eaa8d0_NeikiAnalytics.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2888 set thread context of 1092	2888	dad9dc836645d3a062a5babbd4eaa8d0_NeikiAnalytics.exe	83

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4012	dw20.exe
Token: SeBackupPrivilege	4012	dw20.exe
Token: SeBackupPrivilege	4012	dw20.exe
Token: SeBackupPrivilege	4012	dw20.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1092	2888	dad9dc836645d3a062a5babbd4eaa8d0_NeikiAnalytics.exe	83
PID 2888 wrote to memory of 1092	2888	dad9dc836645d3a062a5babbd4eaa8d0_NeikiAnalytics.exe	83
PID 2888 wrote to memory of 1092	2888	dad9dc836645d3a062a5babbd4eaa8d0_NeikiAnalytics.exe	83
PID 2888 wrote to memory of 1092	2888	dad9dc836645d3a062a5babbd4eaa8d0_NeikiAnalytics.exe	83
PID 2888 wrote to memory of 1092	2888	dad9dc836645d3a062a5babbd4eaa8d0_NeikiAnalytics.exe	83
PID 2888 wrote to memory of 1092	2888	dad9dc836645d3a062a5babbd4eaa8d0_NeikiAnalytics.exe	83
PID 2888 wrote to memory of 1092	2888	dad9dc836645d3a062a5babbd4eaa8d0_NeikiAnalytics.exe	83
PID 2888 wrote to memory of 1092	2888	dad9dc836645d3a062a5babbd4eaa8d0_NeikiAnalytics.exe	83
PID 1092 wrote to memory of 4012	1092	vbc.exe	84
PID 1092 wrote to memory of 4012	1092	vbc.exe	84
PID 1092 wrote to memory of 4012	1092	vbc.exe	84

C:\Users\Admin\AppData\Local\Temp\dad9dc836645d3a062a5babbd4eaa8d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\dad9dc836645d3a062a5babbd4eaa8d0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 776
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4012