Analysis
- max time kernel
60s - max time network
54s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
13/08/2024, 19:43
General
- Target WinRAR 7.01 Pro.exe
- Size 4.3MB
- Sample240813-yfdfwsxdkl
- SHA256 e3635b82438e536636955e2fee251073b1038a7e00295a1e0efb003ad49965d5
Malware Config
Extracted
-
asyncrat
-
Default
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
-
https://api.telegram.org/bot5912059723:AAEvmpZvnGHJALjBBXk_PBuStnzDRsTe4-M/sendMessage?chat_id=750182271
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Async RAT payload 1 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- .NET Reactor proctector 35 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 7 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinRAR 7.01 Pro.exe"C:\Users\Admin\AppData\Local\Temp\WinRAR 7.01 Pro.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winrar_x64_701ar.exe"C:\Users\Admin\AppData\Local\Temp\winrar_x64_701ar.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\_microsoft_corporation.exe"C:\Users\Admin\AppData\Local\Temp\_microsoft_corporation.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
Bookmarks.txt
Process.txt
msgid.dat
_microsoft_corporation.exe
winrar_x64_701ar.exe
memory/2632-0-0x0000000074F9E000-0x0000000074F9F000-memory.dmp
memory/2632-1-0x00000000001E0000-0x0000000000632000-memory.dmp
memory/2632-2-0x0000000005120000-0x00000000051BC000-memory.dmp
memory/3564-63-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-55-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-91-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-93-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-89-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-87-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-85-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-83-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-81-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-79-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-77-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-75-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-73-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-71-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-69-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-67-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-35-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-65-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-61-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-59-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-57-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-39-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-53-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-51-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-49-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-47-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-45-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-43-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-37-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-33-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-31-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-41-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-30-0x0000000004CB0000-0x0000000004D8C000-memory.dmp
memory/3564-2278-0x0000000002670000-0x00000000026A0000-memory.dmp
memory/3564-2279-0x00000000057F0000-0x0000000005856000-memory.dmp
memory/3564-29-0x0000000004CB0000-0x0000000004D92000-memory.dmp
memory/3564-2419-0x0000000006470000-0x0000000006502000-memory.dmp
memory/3564-2423-0x00000000065A0000-0x00000000065AA000-memory.dmp
memory/3564-28-0x0000000004E90000-0x0000000005436000-memory.dmp
memory/3564-2429-0x0000000006EE0000-0x0000000006EF2000-memory.dmp
memory/3564-27-0x0000000004DB0000-0x0000000004E94000-memory.dmp