Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-07-2024 06:06

General

  • Target

    dbacc134902ee72d1464d3b61a3518402b7ab54807bb7b7541fc2916c8119e9e.exe

  • Size

    175KB

  • MD5

    68fad5f5f8de1c290df5d3754b4af358

  • SHA1

    0028395243f38a03b13726915144b9848e8da39a

  • SHA256

    dbacc134902ee72d1464d3b61a3518402b7ab54807bb7b7541fc2916c8119e9e

  • SHA512

    ce44611d5c47fdcb979c715352f5050c816d4e5a814b102836856ede279f774e4709ca48fb95639ca66476ca547176370da7afc5185af066832732da2c80ee01

  • SSDEEP

    3072:ge8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTWwARE+WpCc:06ewwIwQJ6vKX0c5MlYZ0b27

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6082381502:AAEEe5dVvSMdEf-_fKUh7iRqcNun3Q5DzxM/sendMessage?chat_id=5795480469

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 8 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dbacc134902ee72d1464d3b61a3518402b7ab54807bb7b7541fc2916c8119e9e.exe
    "C:\Users\Admin\AppData\Local\Temp\dbacc134902ee72d1464d3b61a3518402b7ab54807bb7b7541fc2916c8119e9e.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1956
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
          PID:216
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show profile
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:3244
        • C:\Windows\SysWOW64\findstr.exe
          findstr All
          3⤵
            PID:5088
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4856
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            3⤵
              PID:4576
            • C:\Windows\SysWOW64\netsh.exe
              netsh wlan show networks mode=bssid
              3⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:5060

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Persistence

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Credential Access

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Web Service

        1
        T1102

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\0b787199a768a6e14a6f6f7da7a589da\Admin@RTDEQSAS_en-US\Browsers\Firefox\Bookmarks.txt
          Filesize

          105B

          MD5

          2e9d094dda5cdc3ce6519f75943a4ff4

          SHA1

          5d989b4ac8b699781681fe75ed9ef98191a5096c

          SHA256

          c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

          SHA512

          d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

        • C:\Users\Admin\AppData\Local\0b787199a768a6e14a6f6f7da7a589da\Admin@RTDEQSAS_en-US\System\Process.txt
          Filesize

          4KB

          MD5

          cf9cd2fd14415f2c10c2ae32ef282041

          SHA1

          e7142a863d74e5379dfe89139b343805edc58b81

          SHA256

          c2a9654ec4671f5a066794e728ac5d1af906d577a0d560f59467f1cb73cd1a3b

          SHA512

          89529caa3444d98394e102ab4766bf7227ecf2da9046094f180f84f881de1f4e68b757bddc5b27f323f07ffe697f570d544d44986747c24bf2dc94c5f9df66de

        • C:\Users\Admin\AppData\Local\36d808d8f994caafffb0d36d0bae8c65\msgid.dat
          Filesize

          1B

          MD5

          cfcd208495d565ef66e7dff9f98764da

          SHA1

          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

          SHA256

          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

          SHA512

          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

        • memory/2748-144-0x00000000746A0000-0x0000000074E50000-memory.dmp
          Filesize

          7.7MB

        • memory/2748-3-0x0000000004D10000-0x0000000004D76000-memory.dmp
          Filesize

          408KB

        • memory/2748-2-0x00000000746A0000-0x0000000074E50000-memory.dmp
          Filesize

          7.7MB

        • memory/2748-0-0x00000000746AE000-0x00000000746AF000-memory.dmp
          Filesize

          4KB

        • memory/2748-146-0x0000000005850000-0x00000000058E2000-memory.dmp
          Filesize

          584KB

        • memory/2748-147-0x0000000005EA0000-0x0000000006444000-memory.dmp
          Filesize

          5.6MB

        • memory/2748-151-0x0000000005970000-0x000000000597A000-memory.dmp
          Filesize

          40KB

        • memory/2748-152-0x00000000746AE000-0x00000000746AF000-memory.dmp
          Filesize

          4KB

        • memory/2748-1-0x0000000000300000-0x0000000000332000-memory.dmp
          Filesize

          200KB

        • memory/2748-158-0x0000000005A50000-0x0000000005A62000-memory.dmp
          Filesize

          72KB

        • memory/2748-181-0x00000000746A0000-0x0000000074E50000-memory.dmp
          Filesize

          7.7MB

        • memory/2748-182-0x00000000746A0000-0x0000000074E50000-memory.dmp
          Filesize

          7.7MB