Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-07-2024 01:28

General

  • Target

    dbacc134902ee72d1464d3b61a3518402b7ab54807bb7b7541fc2916c8119e9e.exe

  • Size

    175KB

  • MD5

    68fad5f5f8de1c290df5d3754b4af358

  • SHA1

    0028395243f38a03b13726915144b9848e8da39a

  • SHA256

    dbacc134902ee72d1464d3b61a3518402b7ab54807bb7b7541fc2916c8119e9e

  • SHA512

    ce44611d5c47fdcb979c715352f5050c816d4e5a814b102836856ede279f774e4709ca48fb95639ca66476ca547176370da7afc5185af066832732da2c80ee01

  • SSDEEP

    3072:ge8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTWwARE+WpCc:06ewwIwQJ6vKX0c5MlYZ0b27

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6082381502:AAEEe5dVvSMdEf-_fKUh7iRqcNun3Q5DzxM/sendMessage?chat_id=5795480469

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 9 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dbacc134902ee72d1464d3b61a3518402b7ab54807bb7b7541fc2916c8119e9e.exe
    "C:\Users\Admin\AppData\Local\Temp\dbacc134902ee72d1464d3b61a3518402b7ab54807bb7b7541fc2916c8119e9e.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4392
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
          PID:3152
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show profile
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:1912
        • C:\Windows\SysWOW64\findstr.exe
          findstr All
          3⤵
            PID:4192
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2636
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            3⤵
              PID:4012
            • C:\Windows\SysWOW64\netsh.exe
              netsh wlan show networks mode=bssid
              3⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:1928

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Persistence

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Credential Access

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        Collection

        Data from Local System

        1
        T1005

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\695e425853551939cd8cba58b49444e5\msgid.dat
          Filesize

          1B

          MD5

          cfcd208495d565ef66e7dff9f98764da

          SHA1

          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

          SHA256

          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

          SHA512

          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

        • C:\Users\Admin\AppData\Local\c2a5ea09649e0598f9753b7cbaf9da19\Admin@WQMJVIBL_en-US\Browsers\Firefox\Bookmarks.txt
          Filesize

          105B

          MD5

          2e9d094dda5cdc3ce6519f75943a4ff4

          SHA1

          5d989b4ac8b699781681fe75ed9ef98191a5096c

          SHA256

          c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

          SHA512

          d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

        • C:\Users\Admin\AppData\Local\c2a5ea09649e0598f9753b7cbaf9da19\Admin@WQMJVIBL_en-US\System\Process.txt
          Filesize

          4KB

          MD5

          2038195a68303d3823f413dc7d0e5c47

          SHA1

          521a6adf29f38be89885e807ff567bf5b039afc5

          SHA256

          f9e4a5b17961316c31bda035e5172e326e54ee39f97024a7bc242a2142a42329

          SHA512

          db6bf8d99f35925f4451ef70355ed8b1a1fe9376deac7273cb778951945cde9f9a351b7296835a80e1b2cb0fcc82d0a33a02b900dba6dc987cb65a9f87545fd8

        • memory/2760-144-0x0000000074840000-0x0000000074FF0000-memory.dmp
          Filesize

          7.7MB

        • memory/2760-3-0x00000000052F0000-0x0000000005356000-memory.dmp
          Filesize

          408KB

        • memory/2760-2-0x0000000074840000-0x0000000074FF0000-memory.dmp
          Filesize

          7.7MB

        • memory/2760-0-0x000000007484E000-0x000000007484F000-memory.dmp
          Filesize

          4KB

        • memory/2760-146-0x0000000005B20000-0x0000000005BB2000-memory.dmp
          Filesize

          584KB

        • memory/2760-147-0x0000000006470000-0x0000000006A14000-memory.dmp
          Filesize

          5.6MB

        • memory/2760-151-0x0000000005F50000-0x0000000005F5A000-memory.dmp
          Filesize

          40KB

        • memory/2760-1-0x00000000008D0000-0x0000000000902000-memory.dmp
          Filesize

          200KB

        • memory/2760-157-0x000000007484E000-0x000000007484F000-memory.dmp
          Filesize

          4KB

        • memory/2760-158-0x0000000074840000-0x0000000074FF0000-memory.dmp
          Filesize

          7.7MB

        • memory/2760-159-0x0000000074840000-0x0000000074FF0000-memory.dmp
          Filesize

          7.7MB