Analysis

  • max time kernel
    595s
  • max time network
    434s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-07-2024 16:05

General

  • Target

    Builder.exe

  • Size

    273KB

  • MD5

    2a388e389df3136db839745d13a2bbd0

  • SHA1

    1ba063842110c80d2a6bdf8280ec88b426b9d4ea

  • SHA256

    a2251164857af32d0a13d3d91c9cb17af07f5858ad935c666a4787f12d585622

  • SHA512

    01715c872281fffd8587f5cdabb5a9d80c720871424a6bf50ad0e8de7aae69536d0d4ffecb611ecfb8e98190e96b8ba896c96bf2dc0ebdda511f74909b5cb559

  • SSDEEP

    3072:Ee8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTiwARE+WpC/Bz65/M6If+3JC:g6ewwIwQJ6vKX0c5MlYZ0b2zFxBt25

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot5602729079:AAHue5HGrezQGgwKeWyn3WQgaqOZM5nlF_c/sendMessage?chat_id=6067717150

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Builder.exe
    "C:\Users\Admin\AppData\Local\Temp\Builder.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1932
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
          PID:4976
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show profile
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:4104
        • C:\Windows\SysWOW64\findstr.exe
          findstr All
          3⤵
            PID:1916
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3856
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            3⤵
              PID:1084
            • C:\Windows\SysWOW64\netsh.exe
              netsh wlan show networks mode=bssid
              3⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:1732

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Persistence

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Credential Access

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Web Service

        1
        T1102

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\4525e4682b3120724e35be72cf8daeee\msgid.dat
          Filesize

          1B

          MD5

          cfcd208495d565ef66e7dff9f98764da

          SHA1

          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

          SHA256

          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

          SHA512

          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

        • C:\Users\Admin\AppData\Local\8eb819baae042bca64babe0ebc72119b\Admin@ANYSUCUO_en-US\Browsers\Firefox\Bookmarks.txt
          Filesize

          105B

          MD5

          2e9d094dda5cdc3ce6519f75943a4ff4

          SHA1

          5d989b4ac8b699781681fe75ed9ef98191a5096c

          SHA256

          c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

          SHA512

          d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

        • C:\Users\Admin\AppData\Local\8eb819baae042bca64babe0ebc72119b\Admin@ANYSUCUO_en-US\System\Process.txt
          Filesize

          4KB

          MD5

          eb53dbbf37fd80b0ab424f0af57a5544

          SHA1

          76e3df3dc8e849f2f951f04e85de2b7f3794c9f7

          SHA256

          58d404284bbffc77ac2806915f40b816a48334f07f00694c1cf9cb38b0701591

          SHA512

          35800bda02f51df49893ba45e9e4e2d8d554e67c8aa2d3c3ff251a634e062ec7dfc5179a937ac1290ebbd32af1ccd0d753160d463699d6c8ceec5241109eec00

        • memory/1552-144-0x0000000074E70000-0x0000000075620000-memory.dmp
          Filesize

          7.7MB

        • memory/1552-3-0x0000000005020000-0x0000000005086000-memory.dmp
          Filesize

          408KB

        • memory/1552-2-0x0000000074E70000-0x0000000075620000-memory.dmp
          Filesize

          7.7MB

        • memory/1552-0-0x0000000074E7E000-0x0000000074E7F000-memory.dmp
          Filesize

          4KB

        • memory/1552-146-0x0000000005870000-0x0000000005902000-memory.dmp
          Filesize

          584KB

        • memory/1552-147-0x0000000005FC0000-0x0000000006564000-memory.dmp
          Filesize

          5.6MB

        • memory/1552-151-0x0000000005A80000-0x0000000005A8A000-memory.dmp
          Filesize

          40KB

        • memory/1552-1-0x0000000000600000-0x000000000064A000-memory.dmp
          Filesize

          296KB

        • memory/1552-157-0x0000000005C70000-0x0000000005C82000-memory.dmp
          Filesize

          72KB

        • memory/1552-180-0x0000000074E7E000-0x0000000074E7F000-memory.dmp
          Filesize

          4KB

        • memory/1552-181-0x0000000074E70000-0x0000000075620000-memory.dmp
          Filesize

          7.7MB

        • memory/1552-182-0x0000000074E70000-0x0000000075620000-memory.dmp
          Filesize

          7.7MB