Analysis
-
max time kernel
101s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-08-2024 12:03
Static task
static1
Behavioral task
behavioral1
Sample
600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe
Resource
win11-20240802-en
General
-
Target
600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe
-
Size
331KB
-
MD5
63b427f3875eaf7475491877a49f71c5
-
SHA1
8d6a1d3ce30eec4284cc3303fdf12a22a12f2a82
-
SHA256
600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1
-
SHA512
c9ee7f62f028aafe4a2753e50c61a1ae25816d586f6eb080d6ff20be0f7d27f8b5b384ad473625042e76b2e708cf0407e52d8a6fda5c9f1ffc0caf40a4636a3c
-
SSDEEP
6144:eEjIabdDyAnk2S5dE1hQqX9lecEEMH9O1BNI:eAIabd7nkc1h9X9Mo7I
Malware Config
Extracted
asyncrat
Default
157.20.182.172:3232
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 3852 created 3292 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 52 PID 3852 created 3292 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 52 -
Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/3668-2-0x0000028E30D00000-0x0000028E30D16000-memory.dmp family_asyncrat -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 notepad.exe Key opened \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 notepad.exe Key opened \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 notepad.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com 4 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 4584 cmd.exe 4232 netsh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 notepad.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier notepad.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe 3668 notepad.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3668 notepad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 PID 3852 wrote to memory of 3668 3852 600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe 82 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 notepad.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 notepad.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe"C:\Users\Admin\AppData\Local\Temp\600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3852
-
-
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3668 -
C:\Windows\System32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4584 -
C:\Windows\System32\chcp.comchcp 650014⤵PID:480
-
-
C:\Windows\System32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4232
-
-
C:\Windows\System32\findstr.exefindstr All4⤵PID:2096
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid3⤵PID:3672
-
C:\Windows\System32\chcp.comchcp 650014⤵PID:2832
-
-
C:\Windows\System32\netsh.exenetsh wlan show networks mode=bssid4⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2092
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\c405fdbbc4d9d368f943cd54bae2d593\Admin@AAPRWBJV_en-US\System\Process.txt
Filesize4KB
MD5fcb1b6a46d442caf8d27e801875c0943
SHA1e15b33fb477d955aa771bb1d841451535b3689b1
SHA2562e2c7895cdfc616c3784824856fe2642a5d0a4b5e9a7a1e3dc32e1ff8d5e02ec
SHA5126affd748ea0534acc1d3783e0ecf5613d0d4f219e04f2e3c9b484bcd87c7ea7ceafabf60ef00bc901d8d9eb46865547ef407f5fc7b09e18c1967c16f37d20e9f