Malware Analysis Report

2024-09-23 03:01

Sample ID 240702-begqla1blf
Target 09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe
SHA256 09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669
Tags
asyncrat stormkitty default persistence privilege_escalation rat stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669

Threat Level: Known bad

The file 09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat stormkitty default persistence privilege_escalation rat stealer

AsyncRat

StormKitty payload

StormKitty

Drops desktop.ini file(s)

Looks up geolocation information via web service

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Event Triggered Execution: Netsh Helper DLL

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks processor information in registry

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-02 01:03

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-02 01:03

Reported

2024-07-02 01:05

Platform

win7-20240220-en

Max time kernel

145s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe"

Signatures

AsyncRat

rat asyncrat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\ccac48237312720d29afef297021ea7e\Admin@BISMIZHX_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\ccac48237312720d29afef297021ea7e\Admin@BISMIZHX_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
File created C:\Users\Admin\AppData\Local\ccac48237312720d29afef297021ea7e\Admin@BISMIZHX_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
File created C:\Users\Admin\AppData\Local\ccac48237312720d29afef297021ea7e\Admin@BISMIZHX_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
File created C:\Users\Admin\AppData\Local\ccac48237312720d29afef297021ea7e\Admin@BISMIZHX_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Looks up geolocation information via web service

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2924 set thread context of 2480 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2924 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2924 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2924 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2924 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2924 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2924 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2924 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2924 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2924 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2924 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2924 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2924 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2480 wrote to memory of 2696 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 2696 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 2696 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 2696 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 2696 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 2696 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 2696 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2696 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2696 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2696 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2696 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2696 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2696 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2696 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2696 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2696 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2696 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2696 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2696 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2696 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2696 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2696 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2696 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2696 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2696 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2696 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2696 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2696 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2480 wrote to memory of 1028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 1028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 1028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 1028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 1028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 1028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 1028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 2164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1028 wrote to memory of 2164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1028 wrote to memory of 2164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1028 wrote to memory of 2164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1028 wrote to memory of 2164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1028 wrote to memory of 2164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1028 wrote to memory of 2164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1028 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1028 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1028 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1028 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1028 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1028 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1028 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe

"C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 icanhazip.com udp
US 104.16.185.241:80 icanhazip.com tcp
US 8.8.8.8:53 api.mylnikov.org udp
US 104.21.44.66:443 api.mylnikov.org tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:6606 tcp

Files

memory/2924-0-0x0000000000D50000-0x0000000000DD4000-memory.dmp

memory/2924-1-0x00000000004E0000-0x0000000000524000-memory.dmp

memory/2924-2-0x0000000000CE0000-0x0000000000CFA000-memory.dmp

memory/2924-3-0x0000000000D40000-0x0000000000D46000-memory.dmp

memory/2480-5-0x0000000000400000-0x0000000000432000-memory.dmp

memory/2480-6-0x0000000000400000-0x0000000000432000-memory.dmp

memory/2480-8-0x0000000000400000-0x0000000000432000-memory.dmp

memory/2480-9-0x0000000000400000-0x0000000000432000-memory.dmp

memory/2480-10-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2480-12-0x0000000000400000-0x0000000000432000-memory.dmp

memory/2480-16-0x0000000000400000-0x0000000000432000-memory.dmp

memory/2480-14-0x0000000000400000-0x0000000000432000-memory.dmp

memory/2480-83-0x0000000000BE0000-0x0000000000C20000-memory.dmp

C:\Users\Admin\AppData\Local\e969a13c26976db0d9f61051b972460e\msgid.dat

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

memory/2480-92-0x0000000000BE0000-0x0000000000C20000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-02 01:03

Reported

2024-07-02 01:05

Platform

win10v2004-20240611-en

Max time kernel

145s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe"

Signatures

AsyncRat

rat asyncrat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\fde07eb82f9e35ee698e139a3491c49f\Admin@PXHSTPPU_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
File created C:\Users\Admin\AppData\Local\fde07eb82f9e35ee698e139a3491c49f\Admin@PXHSTPPU_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
File created C:\Users\Admin\AppData\Local\fde07eb82f9e35ee698e139a3491c49f\Admin@PXHSTPPU_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
File created C:\Users\Admin\AppData\Local\fde07eb82f9e35ee698e139a3491c49f\Admin@PXHSTPPU_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\fde07eb82f9e35ee698e139a3491c49f\Admin@PXHSTPPU_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
File created C:\Users\Admin\AppData\Local\fde07eb82f9e35ee698e139a3491c49f\Admin@PXHSTPPU_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\fde07eb82f9e35ee698e139a3491c49f\Admin@PXHSTPPU_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
File created C:\Users\Admin\AppData\Local\fde07eb82f9e35ee698e139a3491c49f\Admin@PXHSTPPU_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Looks up geolocation information via web service

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 696 set thread context of 3712 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 696 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 696 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 696 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 696 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 696 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 696 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 696 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 696 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3712 wrote to memory of 3116 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 3712 wrote to memory of 3116 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 3712 wrote to memory of 3116 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 3116 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3116 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3116 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3116 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3116 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3116 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3116 wrote to memory of 4212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3116 wrote to memory of 4212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3116 wrote to memory of 4212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3712 wrote to memory of 1252 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 3712 wrote to memory of 1252 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 3712 wrote to memory of 1252 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 1252 wrote to memory of 2196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1252 wrote to memory of 2196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1252 wrote to memory of 2196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1252 wrote to memory of 1400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1252 wrote to memory of 1400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1252 wrote to memory of 1400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe

"C:\Users\Admin\AppData\Local\Temp\09dcf54c74a3669c9cd811df04f84601c723a7e7457b414e15a842192b8df669.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4056,i,8447163055677043976,7218082390179600880,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 13.107.42.16:443 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 icanhazip.com udp
US 104.16.184.241:80 icanhazip.com tcp
US 8.8.8.8:53 api.mylnikov.org udp
US 172.67.196.114:443 api.mylnikov.org tcp
US 8.8.8.8:53 241.184.16.104.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 114.196.67.172.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
N/A 127.0.0.1:6606 tcp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
N/A 127.0.0.1:6606 tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
N/A 127.0.0.1:8808 tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:7707 tcp

Files

memory/696-0-0x0000000074F8E000-0x0000000074F8F000-memory.dmp

memory/696-1-0x0000000000860000-0x00000000008E4000-memory.dmp

memory/696-2-0x0000000005DE0000-0x0000000006384000-memory.dmp

memory/696-3-0x00000000058D0000-0x0000000005962000-memory.dmp

memory/696-4-0x0000000005970000-0x0000000005A0C000-memory.dmp

memory/696-5-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/696-6-0x0000000005A10000-0x0000000005A54000-memory.dmp

memory/696-7-0x0000000005CD0000-0x0000000005CDA000-memory.dmp

memory/696-8-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/696-9-0x0000000006E20000-0x0000000006E3A000-memory.dmp

memory/696-10-0x0000000009B30000-0x0000000009B36000-memory.dmp

memory/696-11-0x0000000074F8E000-0x0000000074F8F000-memory.dmp

memory/696-12-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/3712-13-0x0000000000400000-0x0000000000432000-memory.dmp

memory/3712-16-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/696-15-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/3712-17-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/3712-18-0x00000000053D0000-0x0000000005436000-memory.dmp

C:\Users\Admin\AppData\Local\fde07eb82f9e35ee698e139a3491c49f\Admin@PXHSTPPU_en-US\System\Process.txt

MD5 351702de90f8b701f79e09812bec4c35
SHA1 db8b5a0e8d956f2aba70c1654bccadb7360c3bde
SHA256 e898d6b3354f96c78d28a28821c6dc652d980b7310d65559d60806244d816ca0
SHA512 088299271b4c393fcec07b97fa66519d716d38e4443db870d3145b0144c83410b1f1789a8fe9e64f1bc49bddc0cbc026bb1177f1434e04e8f2a0b23240ce72bd

memory/3712-168-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/3712-173-0x0000000006110000-0x000000000611A000-memory.dmp

C:\Users\Admin\AppData\Local\10c099b054d4fb1c0fb406152849cbcb\msgid.dat

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

memory/3712-179-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/3712-180-0x0000000006480000-0x0000000006492000-memory.dmp

memory/3712-203-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/3712-204-0x0000000074F80000-0x0000000075730000-memory.dmp