Analysis

  • max time kernel
    139s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-08-2024 12:03

General

  • Target

    600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe

  • Size

    331KB

  • MD5

    63b427f3875eaf7475491877a49f71c5

  • SHA1

    8d6a1d3ce30eec4284cc3303fdf12a22a12f2a82

  • SHA256

    600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1

  • SHA512

    c9ee7f62f028aafe4a2753e50c61a1ae25816d586f6eb080d6ff20be0f7d27f8b5b384ad473625042e76b2e708cf0407e52d8a6fda5c9f1ffc0caf40a4636a3c

  • SSDEEP

    6144:eEjIabdDyAnk2S5dE1hQqX9lecEEMH9O1BNI:eAIabd7nkc1h9X9Mo7I

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

157.20.182.172:3232

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Async RAT payload 1 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3432
      • C:\Users\Admin\AppData\Local\Temp\600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe
        "C:\Users\Admin\AppData\Local\Temp\600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:4764
      • C:\Windows\System32\notepad.exe
        C:\Windows\System32\notepad.exe
        2⤵
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:4828
        • C:\Windows\System32\cmd.exe
          "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
          3⤵
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:852
          • C:\Windows\System32\chcp.com
            chcp 65001
            4⤵
              PID:3064
            • C:\Windows\System32\netsh.exe
              netsh wlan show profile
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:4048
            • C:\Windows\System32\findstr.exe
              findstr All
              4⤵
                PID:2484
            • C:\Windows\System32\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
              3⤵
                PID:1544
                • C:\Windows\System32\chcp.com
                  chcp 65001
                  4⤵
                    PID:2528
                  • C:\Windows\System32\netsh.exe
                    netsh wlan show networks mode=bssid
                    4⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:2320

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\d79283e5b49dfaf1672975b4d6531e30\Admin@UXMRPRRI_en-US\Browsers\Mozilla\Firefox\Bookmarks.txt

              Filesize

              105B

              MD5

              2e9d094dda5cdc3ce6519f75943a4ff4

              SHA1

              5d989b4ac8b699781681fe75ed9ef98191a5096c

              SHA256

              c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

              SHA512

              d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

            • C:\Users\Admin\AppData\Local\d79283e5b49dfaf1672975b4d6531e30\Admin@UXMRPRRI_en-US\System\Process.txt

              Filesize

              3KB

              MD5

              d1397a6a2941197f7d4736d48c219af7

              SHA1

              c7210d49555ee393af815d760fbb3f4b888d66d1

              SHA256

              f30f75a0a28eebc67e9b5d4735a6a90521aa955d742906c91f1f7f8038376bf7

              SHA512

              482a12fdbc4ac56a39f0b68dd6eb56804847e97eddebeaf33d08ef70337b253712f7be85a940263fa5dfa4cd3f507bfc5a04f33346a73931500d7aab0fc426dd

            • C:\Users\Admin\AppData\Local\d79283e5b49dfaf1672975b4d6531e30\Admin@UXMRPRRI_en-US\System\Process.txt

              Filesize

              4KB

              MD5

              22036841d93bb653ef4a20b251e9a321

              SHA1

              87f7843de5db546b6a773c9f5fe7e56e836b3851

              SHA256

              cce0084c20ee81b3e76bfcbd8331c5a833410eaf262daf1c0ac36e2f630b2a1b

              SHA512

              7505d081ef6b4385f30b55a24d0a730f9267552cd573db1f01cf30b7944c680486f41c3bd0e4e894f1a180d2fb16e3742a96be5c7f90dae446aaa420b7896b8e

            • memory/4828-7-0x00007FFDA1703000-0x00007FFDA1705000-memory.dmp

              Filesize

              8KB

            • memory/4828-18-0x00007FFDA1700000-0x00007FFDA21C1000-memory.dmp

              Filesize

              10.8MB

            • memory/4828-0-0x00000213ED6E0000-0x00000213ED6F6000-memory.dmp

              Filesize

              88KB

            • memory/4828-8-0x00007FFDA1700000-0x00007FFDA21C1000-memory.dmp

              Filesize

              10.8MB

            • memory/4828-9-0x00000213F1090000-0x00000213F1106000-memory.dmp

              Filesize

              472KB

            • memory/4828-10-0x00000213F1110000-0x00000213F1298000-memory.dmp

              Filesize

              1.5MB

            • memory/4828-11-0x00000213EF320000-0x00000213EF33E000-memory.dmp

              Filesize

              120KB

            • memory/4828-14-0x00007FFDA1700000-0x00007FFDA21C1000-memory.dmp

              Filesize

              10.8MB

            • memory/4828-17-0x00000213F1080000-0x00000213F108A000-memory.dmp

              Filesize

              40KB

            • memory/4828-4-0x00007FFDA1700000-0x00007FFDA21C1000-memory.dmp

              Filesize

              10.8MB

            • memory/4828-20-0x00007FFDA1700000-0x00007FFDA21C1000-memory.dmp

              Filesize

              10.8MB

            • memory/4828-3-0x00007FFDA1700000-0x00007FFDA21C1000-memory.dmp

              Filesize

              10.8MB

            • memory/4828-2-0x00000213EF240000-0x00000213EF256000-memory.dmp

              Filesize

              88KB

            • memory/4828-160-0x00007FFDA1700000-0x00007FFDA21C1000-memory.dmp

              Filesize

              10.8MB

            • memory/4828-162-0x00007FFDA1700000-0x00007FFDA21C1000-memory.dmp

              Filesize

              10.8MB

            • memory/4828-174-0x00000213F1710000-0x00000213F178A000-memory.dmp

              Filesize

              488KB

            • memory/4828-1-0x00007FFDA1703000-0x00007FFDA1705000-memory.dmp

              Filesize

              8KB

            • memory/4828-209-0x00007FFDA1700000-0x00007FFDA21C1000-memory.dmp

              Filesize

              10.8MB

            • memory/4828-210-0x00007FFDA1700000-0x00007FFDA21C1000-memory.dmp

              Filesize

              10.8MB