Analysis
- max time kernel
11s - max time network
8s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
09/06/2024, 20:41
General
- Target Apache.exe
- Size 332KB
- Sample240609-zgynwsfd67
- SHA256 1cb45a0efbaa43f93473572aab522d15e7190f8358545f8c8c9f49ef64884783
Malware Config
Extracted
-
asyncrat
-
Default
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
-
https://api.telegram.org/bot6077946925:AAEgsuyqKoNY1C3XxGrN_IXiaMHr9Oc6Vp4/sendMessage?chat_id=5761333594
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Extracted
-
xworm
-
0LLXgeoJ4l4QFpG6
-
install_file
USBDriver.exe
-
pastebin_url
https://pastebin.com/raw/FrUYqTuA
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Detect Xworm Payload 1 IoCs
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Async RAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 6 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops desktop.ini file(s) 7 IoCs
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Apache.exe"C:\Users\Admin\AppData\Local\Temp\Apache.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\apache.exec:\users\admin\appdata\local\temp\apache.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'apache.exe '3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\apache.exe '3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\apache.exe '3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "apache" /tr "C:\ProgramData\apache.exe "3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
Process.txt
Process.txt
Process.txt
Process.txt
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_b5hd2si4.4hv.ps1
icsys.icn.exe
spoolsv.exe
svchost.exe
apache.exe
explorer.exe
memory/1048-92-0x000000001C500000-0x000000001C532000-memory.dmp
memory/1048-10-0x00007FFB57093000-0x00007FFB57095000-memory.dmp
memory/1048-9-0x0000000000190000-0x00000000001C8000-memory.dmp
memory/1048-15-0x00007FFB57090000-0x00007FFB57B51000-memory.dmp
memory/1048-93-0x000000001B470000-0x000000001B484000-memory.dmp
memory/1068-60-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1068-62-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1632-61-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1632-48-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1952-54-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1980-32-0x000001C0B4C30000-0x000001C0B4C52000-memory.dmp
memory/1980-67-0x000001C0B4E00000-0x000001C0B501C000-memory.dmp
memory/2324-0-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2324-65-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2856-24-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3520-18-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3520-66-0x0000000000400000-0x000000000041F000-memory.dmp