asyncrat | 40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff

Resubmissions

20/12/2024, 17:30

241220-v3ka6szqez10

20/12/2024, 14:21

11/12/2024, 16:57

01/08/2024, 19:42

01/08/2024, 19:39

01/08/2024, 01:19

Analysis

max time kernel
79s
max time network
82s
platform
windows11-21h2_x64
resource
win11-20240730-en
resource tags

arch:x64arch:x86image:win11-20240730-enlocale:en-usos:windows11-21h2-x64system
submitted
01/08/2024, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
Size 175KB
Sample240801-ydeaeazclc
SHA256 40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff
MD5 19f436930646f3e8f283fa71f2a4cbcb
SHA1 99397666d23ddde6078496ee73bde00ae9403393
SHA512 addba9ff5bd334ddfec06f87d2c69c06028b82d0aab732f73ef35e84f46d889f48ab6823371a9b9f415e2758e62270866682b833bca7406354802e0157314e0d
SSDEEP 3072:+e8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTDwARE+WpCc:W6ewwIwQJ6vKX0c5MlYZ0b2E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat stormkitty default credential_access discovery persistence privilege_escalation rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=5795480469

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/3256-1-0x0000000000620000-0x0000000000652000-memory.dmp	family_stormkitty

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 16 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\5b214429d8387dd7e28e90606dec8c55\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
File created	C:\Users\Admin\AppData\Local\5b214429d8387dd7e28e90606dec8c55\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
File created	C:\Users\Admin\AppData\Local\e86cffeccd745510e987c16d14c4f30b\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
File created	C:\Users\Admin\AppData\Local\e86cffeccd745510e987c16d14c4f30b\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
File created	C:\Users\Admin\AppData\Local\e86cffeccd745510e987c16d14c4f30b\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
File created	C:\Users\Admin\AppData\Local\e86cffeccd745510e987c16d14c4f30b\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
File created	C:\Users\Admin\AppData\Local\5b214429d8387dd7e28e90606dec8c55\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
File created	C:\Users\Admin\AppData\Local\e86cffeccd745510e987c16d14c4f30b\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
File opened for modification	C:\Users\Admin\AppData\Local\e86cffeccd745510e987c16d14c4f30b\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
File opened for modification	C:\Users\Admin\AppData\Local\e86cffeccd745510e987c16d14c4f30b\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
File opened for modification	C:\Users\Admin\AppData\Local\e86cffeccd745510e987c16d14c4f30b\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
File created	C:\Users\Admin\AppData\Local\e86cffeccd745510e987c16d14c4f30b\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
File created	C:\Users\Admin\AppData\Local\5b214429d8387dd7e28e90606dec8c55\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
File opened for modification	C:\Users\Admin\AppData\Local\5b214429d8387dd7e28e90606dec8c55\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
File created	C:\Users\Admin\AppData\Local\5b214429d8387dd7e28e90606dec8c55\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
File created	C:\Users\Admin\AppData\Local\5b214429d8387dd7e28e90606dec8c55\Admin@XEGYFDPH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	icanhazip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3532	cmd.exe
4884	netsh.exe
2264	cmd.exe
1880	netsh.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1974522869-4251526421-3305193628-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
Token: SeDebugPrivilege	1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4388	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 3532	3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe	82
PID 3256 wrote to memory of 3532	3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe	82
PID 3256 wrote to memory of 3532	3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe	82
PID 3532 wrote to memory of 2928	3532	cmd.exe	84
PID 3532 wrote to memory of 2928	3532	cmd.exe	84
PID 3532 wrote to memory of 2928	3532	cmd.exe	84
PID 3532 wrote to memory of 4884	3532	cmd.exe	85
PID 3532 wrote to memory of 4884	3532	cmd.exe	85
PID 3532 wrote to memory of 4884	3532	cmd.exe	85
PID 3532 wrote to memory of 2060	3532	cmd.exe	86
PID 3532 wrote to memory of 2060	3532	cmd.exe	86
PID 3532 wrote to memory of 2060	3532	cmd.exe	86
PID 3256 wrote to memory of 2524	3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe	87
PID 3256 wrote to memory of 2524	3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe	87
PID 3256 wrote to memory of 2524	3256	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe	87
PID 2524 wrote to memory of 4500	2524	cmd.exe	89
PID 2524 wrote to memory of 4500	2524	cmd.exe	89
PID 2524 wrote to memory of 4500	2524	cmd.exe	89
PID 2524 wrote to memory of 4336	2524	cmd.exe	90
PID 2524 wrote to memory of 4336	2524	cmd.exe	90
PID 2524 wrote to memory of 4336	2524	cmd.exe	90
PID 1204 wrote to memory of 2264	1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe	97
PID 1204 wrote to memory of 2264	1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe	97
PID 1204 wrote to memory of 2264	1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe	97
PID 2264 wrote to memory of 1476	2264	cmd.exe	99
PID 2264 wrote to memory of 1476	2264	cmd.exe	99
PID 2264 wrote to memory of 1476	2264	cmd.exe	99
PID 2264 wrote to memory of 1880	2264	cmd.exe	100
PID 2264 wrote to memory of 1880	2264	cmd.exe	100
PID 2264 wrote to memory of 1880	2264	cmd.exe	100
PID 2264 wrote to memory of 2212	2264	cmd.exe	101
PID 2264 wrote to memory of 2212	2264	cmd.exe	101
PID 2264 wrote to memory of 2212	2264	cmd.exe	101
PID 1204 wrote to memory of 3692	1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe	102
PID 1204 wrote to memory of 3692	1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe	102
PID 1204 wrote to memory of 3692	1204	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe	102
PID 3692 wrote to memory of 2332	3692	cmd.exe	104
PID 3692 wrote to memory of 2332	3692	cmd.exe	104
PID 3692 wrote to memory of 2332	3692	cmd.exe	104
PID 3692 wrote to memory of 4904	3692	cmd.exe	105
PID 3692 wrote to memory of 4904	3692	cmd.exe	105
PID 3692 wrote to memory of 4904	3692	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
"C:\Users\Admin\AppData\Local\Temp\40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe"
1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2928
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4884
- - C:\Windows\SysWOW64\findstr.exe
    findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4500
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4336

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2696

C:\Users\Admin\AppData\Local\Temp\40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe
"C:\Users\Admin\AppData\Local\Temp\40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff.exe"
1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1476
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1880
- - C:\Windows\SysWOW64\findstr.exe
    findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2332
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Process.txt

Path C:\Users\Admin\AppData\Local\5b214429d8387dd7e28e90606dec8c55\Admin@XEGYFDPH_en-US\System\Process.txt
Size 4KB
SHA256 523b1b20a8d9328111e70fdd1acc16230985c64d5769ddcfc966af51714f65d5
MD5 d4a9c57de29b8e6e417253622dff695c
SHA1 3fe548893948c0fed95ee9228f884f3c745c4d70
SHA512 98eeb168454b4a6b59fe8bf76a41a57f9f7bce6ff8a49740344a274f7916ef8383fe39225f944e8fcc698735b3c0c7bb404118cc8b50020a30ca199e429b774f
SSDEEP 48:lEDs5UBgfPVJEMFMuG6DbcEpAhux2HujYLX1OX23SN:lmBgfHJq56DwIAatYLX1OX232
MD5 SHA1 SHA512 SSDEEP

Submit Download

msgid.dat

Path C:\Users\Admin\AppData\Local\627f15b3bc02260be74d8e66f14a9852\msgid.dat
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

places.raw

Path C:\Users\Admin\AppData\Local\Temp\places.raw
Size 5.0MB
SHA256 51edf88baf821ddd3e0243690686cf1165bb0236c342db288a3522aacbd68673
MD5 1bb74fc582d99a05f5e4a57e0c30a384
SHA1 d0cef50f1b6696918562f28057ddc108d50cdb82
SHA512 38cf2fa187ac4ca53f64226ce7c8b925c32bcd9ab846a7d98677c7f78c62a2e978fb663b107819cfe75adc220e9121191c36c362988e8f804e1aad033a8f26eb
SSDEEP 192:28rJQaXoMXp0VW9FxWHMt2nQh86MeGJK:28r54w0VW3xWA2
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1940.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp1940.tmp.dat
Size 114KB
SHA256 8d95ff19d697afe7bfd166c4ffc38921fae8434043c09c900c303841acb36ce1
MD5 14f9823c7f73af418659d716fc91c0d1
SHA1 56eca072fcba259cf0813ef67bdd8d663825a865
SHA512 a9c0547671cfa4558a2b9a1e1501e50004d7d4d1cc1014dffe8bb8e91ccbee9c611f210f93bdc5e397161d15a4181b99c98c4e380626aa1488b48a0c855a3f18
SSDEEP 192:KZPM23W/l1jXhPE4nP+hoIky6cVqLVumf:I02m/lxhlnmhouHcVumf
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1951.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp1951.tmp.dat
Size 160KB
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad
SSDEEP 96:bBY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:bBY/tH+bF+UI3iWGVYWNkqp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1964.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp1964.tmp.dat
Size 112KB
SHA256 eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
MD5 87210e9e528a4ddb09c6b671937c79c6
SHA1 3c75314714619f5b55e25769e0985d497f0062f2
SHA512 f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0
SSDEEP 192:EAogLUJAIH9IqR2nrQTjHbRmn8HKuqrTPGTATVumQ6:EAofJAa9Ijnh8HKuqrTxVumQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\e86cffeccd745510e987c16d14c4f30b\Admin@XEGYFDPH_en-US\Browsers\Firefox\Bookmarks.txt
Size 105B
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
MD5 SHA1 SHA512

Submit Download

Process.txt

Path C:\Users\Admin\AppData\Local\e86cffeccd745510e987c16d14c4f30b\Admin@XEGYFDPH_en-US\System\Process.txt
Size 4KB
SHA256 4775e33c7545d6221955aa456d6d509c36f8ede28095c117eec4a0fd4ebaa567
MD5 1c0d9d8ba089e26f65f1308b2fcb0f13
SHA1 4f9719ba93f60e1c85db5e6675328db9d0e96e9d
SHA512 d62d104408f931fae1a2b0f91119f905453314d5286b42190f2160e7c9412621fc0d76721147f13cc6453803b21f6ff516ebcbe8cb80428c724e1f9aeba48581
SSDEEP 48:lEDs5UBgfPpFMdJEMFMuG6DbcEpAhux2HujYLX2BnOX23S8:lmBgfxq3Jq56DwIAatYLX2BnOX23N
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3256-140-0x0000000005C70000-0x0000000005D02000-memory.dmp

Download

memory/3256-151-0x000000007490E000-0x000000007490F000-memory.dmp

Download

memory/3256-0-0x000000007490E000-0x000000007490F000-memory.dmp

Download

memory/3256-152-0x0000000074900000-0x00000000750B1000-memory.dmp

Download

memory/3256-2-0x0000000074900000-0x00000000750B1000-memory.dmp

Download

memory/3256-141-0x00000000062C0000-0x0000000006866000-memory.dmp

Download

memory/3256-145-0x0000000005D60000-0x0000000005D6A000-memory.dmp

Download

memory/3256-1-0x0000000000620000-0x0000000000652000-memory.dmp

Download

memory/3256-3-0x00000000050C0000-0x0000000005126000-memory.dmp

Download