Analysis

  • max time kernel
    146s
  • max time network
    132s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240704-en
  • resource tags

    arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07-07-2024 06:06

General

  • Target

    dbacc134902ee72d1464d3b61a3518402b7ab54807bb7b7541fc2916c8119e9e.exe

  • Size

    175KB

  • MD5

    68fad5f5f8de1c290df5d3754b4af358

  • SHA1

    0028395243f38a03b13726915144b9848e8da39a

  • SHA256

    dbacc134902ee72d1464d3b61a3518402b7ab54807bb7b7541fc2916c8119e9e

  • SHA512

    ce44611d5c47fdcb979c715352f5050c816d4e5a814b102836856ede279f774e4709ca48fb95639ca66476ca547176370da7afc5185af066832732da2c80ee01

  • SSDEEP

    3072:ge8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTWwARE+WpCc:06ewwIwQJ6vKX0c5MlYZ0b27

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6082381502:AAEEe5dVvSMdEf-_fKUh7iRqcNun3Q5DzxM/sendMessage?chat_id=5795480469

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 8 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dbacc134902ee72d1464d3b61a3518402b7ab54807bb7b7541fc2916c8119e9e.exe
    "C:\Users\Admin\AppData\Local\Temp\dbacc134902ee72d1464d3b61a3518402b7ab54807bb7b7541fc2916c8119e9e.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4608
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3288
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
          PID:3768
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show profile
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:1344
        • C:\Windows\SysWOW64\findstr.exe
          findstr All
          3⤵
            PID:5072
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2100
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            3⤵
              PID:1432
            • C:\Windows\SysWOW64\netsh.exe
              netsh wlan show networks mode=bssid
              3⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:3892

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Persistence

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Credential Access

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Web Service

        1
        T1102

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\360e56fc88473fafc8b1b2f8f6f490b3\Admin@QFGVEBLJ_en-US\System\Process.txt
          Filesize

          4KB

          MD5

          d8395c1646aa3a5b3ceb1e9fa668a05e

          SHA1

          38d5f2b3f1ab5513085da9073c159ea2df44c4cb

          SHA256

          5f95fa447219e4a448ae53f00c50490438389e83338cc9384c11d83408fcd0b1

          SHA512

          135d31c6d8f811cc3192135bd64f54e3eb15468326de55ff30885780ff75d3dbfbd03100095d2407e7ba4cdeb105a03ec8cdd708e179089ea71b37936893ea69

        • C:\Users\Admin\AppData\Local\e10f8a56383a3db3f0659257da71ed0a\msgid.dat
          Filesize

          1B

          MD5

          cfcd208495d565ef66e7dff9f98764da

          SHA1

          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

          SHA256

          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

          SHA512

          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

        • memory/4608-3-0x0000000005780000-0x00000000057E6000-memory.dmp
          Filesize

          408KB

        • memory/4608-0-0x000000007484E000-0x000000007484F000-memory.dmp
          Filesize

          4KB

        • memory/4608-2-0x0000000074840000-0x0000000074FF1000-memory.dmp
          Filesize

          7.7MB

        • memory/4608-142-0x00000000060C0000-0x0000000006152000-memory.dmp
          Filesize

          584KB

        • memory/4608-143-0x0000000074840000-0x0000000074FF1000-memory.dmp
          Filesize

          7.7MB

        • memory/4608-144-0x0000000006710000-0x0000000006CB6000-memory.dmp
          Filesize

          5.6MB

        • memory/4608-148-0x00000000061D0000-0x00000000061DA000-memory.dmp
          Filesize

          40KB

        • memory/4608-1-0x0000000000DD0000-0x0000000000E02000-memory.dmp
          Filesize

          200KB

        • memory/4608-154-0x0000000006FA0000-0x0000000006FB2000-memory.dmp
          Filesize

          72KB

        • memory/4608-176-0x000000007484E000-0x000000007484F000-memory.dmp
          Filesize

          4KB

        • memory/4608-177-0x0000000074840000-0x0000000074FF1000-memory.dmp
          Filesize

          7.7MB

        • memory/4608-178-0x0000000074840000-0x0000000074FF1000-memory.dmp
          Filesize

          7.7MB