Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-08-2024 12:36
Static task
static1
Behavioral task
behavioral1
Sample
14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe
Resource
win10v2004-20240802-en
General
-
Target
14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe
-
Size
331KB
-
MD5
3a0a8189bb8910131bd13c098a1de18b
-
SHA1
600ff8878e9782ff7d3df847b379eca20d3e3bdd
-
SHA256
14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5
-
SHA512
7c55c20d70f08b0c57390fc1decf1d26573c7e04738f1187e2ab3b8ecb0e3aebc06072f88724735828e114cad6592346c0c6b3a8db90c0b5765571fd5beefb6f
-
SSDEEP
6144:o2x6R9b8D6InoSbfVmEtpMMlRMH9O1BNI:o46R9b87noWYapMMlRMo7I
Malware Config
Extracted
asyncrat
Default
45.66.231.150:3232
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3092 created 3320 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 55 -
Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/1616-2-0x0000020174D20000-0x0000020174D36000-memory.dmp family_asyncrat -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 notepad.exe Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 notepad.exe Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 notepad.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 36 icanhazip.com 38 ip-api.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 1368 cmd.exe 1208 netsh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 notepad.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier notepad.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe 1616 notepad.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1616 notepad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 PID 3092 wrote to memory of 1616 3092 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 85 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 notepad.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 notepad.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe"C:\Users\Admin\AppData\Local\Temp\14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3092
-
-
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1616 -
C:\Windows\System32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1368 -
C:\Windows\System32\chcp.comchcp 650014⤵PID:908
-
-
C:\Windows\System32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1208
-
-
C:\Windows\System32\findstr.exefindstr All4⤵PID:1664
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid3⤵PID:3156
-
C:\Windows\System32\chcp.comchcp 650014⤵PID:4404
-
-
C:\Windows\System32\netsh.exenetsh wlan show networks mode=bssid4⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1272
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\1af02931f6a427a6b6e36285307150c0\Admin@KZYBFHMK_en-US\Browsers\Mozilla\Firefox\Bookmarks.txt
Filesize105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\Users\Admin\AppData\Local\1af02931f6a427a6b6e36285307150c0\Admin@KZYBFHMK_en-US\System\Process.txt
Filesize2KB
MD5cce18cc82101ed148d8c28ef3133463b
SHA1dfe58d399cad25173fd38d32e5f27abcd1dad79e
SHA256407d298adc916f819efb25d30e3e3fa86b35d40296e59ecb0c6eb166bd006fb8
SHA512a719b9fbf6f0481a3ed741cdcf9bc594635a01bdd82fc34d0c75385d4cf61a22ab8de6859157d9b7de953d7a0d5dbf571a12f24ac795d0d3de915bfcb9f40131
-
C:\Users\Admin\AppData\Local\1af02931f6a427a6b6e36285307150c0\Admin@KZYBFHMK_en-US\System\Process.txt
Filesize3KB
MD54298f50d5013cd07eb6896b4607f13eb
SHA1a19ef8beecbe92aaf848b565178aef68317af91d
SHA2568c1354d77a30dde6f0dadfbfb929c7ae96856e0c8bdfb8ad737fa6ec46c58360
SHA512de535f19164af33054aeb77981bfdb85df18a3cdbe5916918c4c1ab3cdedcf9f23566352d43acd6e18e7db2e82116af729d1836050480676f6ae0410856d8ef0
-
C:\Users\Admin\AppData\Local\1af02931f6a427a6b6e36285307150c0\Admin@KZYBFHMK_en-US\System\Process.txt
Filesize4KB
MD5034a770f5fcad650cf609656fc99bf8d
SHA11da51ea87ff8f4274bf5a633998b10fc410a0d5b
SHA25661bc1abd8232e1405339e365f4fb005daca099d21e51b355d0cc1e0dbc25b542
SHA51271b08030b9590f4333396ff03bad49a7584ad671d2d284642a92583d01b8b7c22a9beb4365c31554498ca25cb9520e4f01f5a46f51ef1069f3562fd44f3f709c
-
C:\Users\Admin\AppData\Local\1af02931f6a427a6b6e36285307150c0\Admin@KZYBFHMK_en-US\System\Process.txt
Filesize1KB
MD5c4f21ae630f4d5e788c6ad66e1c61d19
SHA1faa753d2fc2e2178a116f2f1e55698df12e58d12
SHA2568c8e864772bef4582f345477312893365aea8795006ca5b30bf9161cf27ad90c
SHA51253cf98608027535c45174bcc3579ff5a43bbd4c27d9b0b455fc48bdf6e65fc46295e55d93751d6f439d941cc4a085e8b8b07424a0c4f6e7e689b141dfb6d7269