General
-
Target
CryptoFactory.exe
-
Size
5.9MB
-
Sample
240702-rsnztswgnf
-
MD5
1794529e9ab95420902212d29533f2e5
-
SHA1
3c6b517092407bd0027d76b03bc15b3e81f2b7d1
-
SHA256
c978fbdd5ce89e672a624c74e03fa89e0865b20e8bc84b0a882eb327abb96064
-
SHA512
e6a0f2b1d037def332ac11f5d1462434427857e2adfd50c29f25adb5aa2b8b21b867de971e35c628033a08679c4f4259e9119ff3a72f2feed4203c9cc9481285
-
SSDEEP
98304:wJGOYln80EisK9yJND14r0Uhmkl1qa1Egu2Wh/X9Tm0OXcPwQESF/IKc6:aFqnPEZZzeJmkl1qHd2i/9TjElH8QKc
Static task
static1
Behavioral task
behavioral1
Sample
CryptoFactory.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
CryptoFactory.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6082381502:AAEEe5dVvSMdEf-_fKUh7iRqcNun3Q5DzxM/sendMessage?chat_id=5795480469
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
CryptoFactory.exe
-
Size
5.9MB
-
MD5
1794529e9ab95420902212d29533f2e5
-
SHA1
3c6b517092407bd0027d76b03bc15b3e81f2b7d1
-
SHA256
c978fbdd5ce89e672a624c74e03fa89e0865b20e8bc84b0a882eb327abb96064
-
SHA512
e6a0f2b1d037def332ac11f5d1462434427857e2adfd50c29f25adb5aa2b8b21b867de971e35c628033a08679c4f4259e9119ff3a72f2feed4203c9cc9481285
-
SSDEEP
98304:wJGOYln80EisK9yJND14r0Uhmkl1qa1Egu2Wh/X9Tm0OXcPwQESF/IKc6:aFqnPEZZzeJmkl1qHd2i/9TjElH8QKc
-
StormKitty payload
-
Async RAT payload
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1