Analysis
- max time kernel
290s - max time network
298s - platform
windows11-21h2_x64 - resource
win11-20240419-en - resource tags
- submitted
31/05/2024, 04:12
General
- Target System.exe
- Size 3.4MB
- Sample240531-eskaesff93
- SHA256 92ab9ed68950db61024eb5c5180f0019281a3bec96cd5a2f7305f450de064d4f
Malware Config
Extracted
-
asyncrat
-
Venom RAT + HVNC + Stealer + Grabber v6.5
-
Default
-
umldzqgmsvrmiibib
-
c2_url_file
https://paste.fo/raw/53957c5e1888
-
delay
1
-
install
true
-
install_file
Registry.exe
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 27 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\System.exe"C:\Users\Admin\AppData\Local\Temp\System.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Accesses Microsoft Outlook profiles
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Registry" /tr '"C:\Users\Admin\AppData\Roaming\Registry.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Registry" /tr '"C:\Users\Admin\AppData\Roaming\Registry.exe"'3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Process.txt
Process.txt
msgid.dat
tmpD0AA.tmp.dat
tmpD0BD.tmp.dat
memory/3348-46-0x0000000008DE0000-0x0000000009137000-memory.dmp
memory/3348-65-0x00000000762E6000-0x00000000762E7000-memory.dmp
memory/3348-9-0x0000000006240000-0x00000000067E6000-memory.dmp
memory/3348-11-0x0000000007170000-0x0000000007202000-memory.dmp
memory/3348-12-0x0000000007300000-0x000000000730A000-memory.dmp
memory/3348-15-0x0000000007970000-0x0000000007A0C000-memory.dmp
memory/3348-16-0x0000000007B70000-0x0000000007BD6000-memory.dmp
memory/3348-18-0x00000000762D0000-0x00000000763C0000-memory.dmp
memory/3348-20-0x0000000008540000-0x00000000085B6000-memory.dmp
memory/3348-21-0x00000000085C0000-0x00000000086E2000-memory.dmp
memory/3348-22-0x0000000008520000-0x000000000853E000-memory.dmp
memory/3348-0-0x0000000000B80000-0x00000000014A0000-memory.dmp
memory/3348-47-0x00000000083D0000-0x000000000841C000-memory.dmp
memory/3348-63-0x0000000008480000-0x00000000084A2000-memory.dmp
memory/3348-64-0x0000000000B80000-0x00000000014A0000-memory.dmp
memory/3348-8-0x0000000000B80000-0x00000000014A0000-memory.dmp
memory/3348-66-0x0000000009140000-0x0000000009274000-memory.dmp
memory/3348-67-0x0000000008720000-0x000000000872A000-memory.dmp
memory/3348-69-0x00000000762D0000-0x00000000763C0000-memory.dmp
memory/3348-70-0x00000000762D0000-0x00000000763C0000-memory.dmp
memory/3348-71-0x00000000762D0000-0x00000000763C0000-memory.dmp
memory/3348-7-0x0000000000B80000-0x00000000014A0000-memory.dmp
memory/3348-4-0x00000000762D0000-0x00000000763C0000-memory.dmp
memory/3348-3-0x00000000762D0000-0x00000000763C0000-memory.dmp
memory/3348-2-0x00000000762D0000-0x00000000763C0000-memory.dmp
memory/3348-176-0x00000000081A0000-0x000000000821A000-memory.dmp
memory/3348-216-0x00000000094E0000-0x0000000009564000-memory.dmp
memory/3348-218-0x00000000762D0000-0x00000000763C0000-memory.dmp
memory/3348-1-0x00000000762E6000-0x00000000762E7000-memory.dmp