asyncrat | 10c0d4921910751c17d1ab6c74e48a3c9d5be28aa55b80762418765dcdcbe06c

General

Target

IpCam Bruter.exe
Size

143KB
MD5

ff94c762dc8bda27e4e75c4285ab89fa
SHA1

897b8c1939ce10abf5b5b5cbc71883adb8715afe
SHA256

10c0d4921910751c17d1ab6c74e48a3c9d5be28aa55b80762418765dcdcbe06c
SHA512

6df88282d7898a9123459cab326881521e6ad4f39ddf8c5dbb95c0cb5635521673a1a4ada47f4f68fdb948f384912a718bb8f7cf712b5c25377493e0dba26707
SSDEEP

3072:d3YO5kKdXl0ZRBL/Tuny9bdcGZcKRWpgep82z:JYO4RBTTgy9bCdX

Score

10^/10

asyncrat stormkitty credential_access discovery persistence privilege_escalation rat spyware stealer

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4088-1-0x0000027F763B0000-0x0000027F763DA000-memory.dmp	family_stormkitty

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 7 IoCs

Processes:

IpCam Bruter.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\600dd6cb2777db0d0006a90a60ad1538\Admin@HVDPCYGS_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	IpCam Bruter.exe
File opened for modification	C:\Users\Admin\AppData\Local\600dd6cb2777db0d0006a90a60ad1538\Admin@HVDPCYGS_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	IpCam Bruter.exe
File created	C:\Users\Admin\AppData\Local\600dd6cb2777db0d0006a90a60ad1538\Admin@HVDPCYGS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	IpCam Bruter.exe
File created	C:\Users\Admin\AppData\Local\600dd6cb2777db0d0006a90a60ad1538\Admin@HVDPCYGS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	IpCam Bruter.exe
File created	C:\Users\Admin\AppData\Local\600dd6cb2777db0d0006a90a60ad1538\Admin@HVDPCYGS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	IpCam Bruter.exe
File created	C:\Users\Admin\AppData\Local\600dd6cb2777db0d0006a90a60ad1538\Admin@HVDPCYGS_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	IpCam Bruter.exe
File created	C:\Users\Admin\AppData\Local\600dd6cb2777db0d0006a90a60ad1538\Admin@HVDPCYGS_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	IpCam Bruter.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

30 icanhazip.com
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

flow	ioc
30	icanhazip.com

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
discovery

Wi-Fi Discovery
T1016.002

Processes:

cmd.exenetsh.exe

pid process

2328 cmd.exe
3972 netsh.exe

pid	process
2328	cmd.exe
3972	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

IpCam Bruter.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	IpCam Bruter.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	IpCam Bruter.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

IpCam Bruter.exe

pid	process
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe
4088	IpCam Bruter.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

IpCam Bruter.exe

description pid process

Token: SeDebugPrivilege 4088 IpCam Bruter.exe

description	pid	process
Token: SeDebugPrivilege	4088	IpCam Bruter.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

IpCam Bruter.execmd.execmd.exe

description	pid	process	target process
PID 4088 wrote to memory of 2328	4088	IpCam Bruter.exe	cmd.exe
PID 4088 wrote to memory of 2328	4088	IpCam Bruter.exe	cmd.exe
PID 2328 wrote to memory of 3728	2328	cmd.exe	chcp.com
PID 2328 wrote to memory of 3728	2328	cmd.exe	chcp.com
PID 2328 wrote to memory of 3972	2328	cmd.exe	netsh.exe
PID 2328 wrote to memory of 3972	2328	cmd.exe	netsh.exe
PID 2328 wrote to memory of 2312	2328	cmd.exe	findstr.exe
PID 2328 wrote to memory of 2312	2328	cmd.exe	findstr.exe
PID 4088 wrote to memory of 1292	4088	IpCam Bruter.exe	cmd.exe
PID 4088 wrote to memory of 1292	4088	IpCam Bruter.exe	cmd.exe
PID 1292 wrote to memory of 796	1292	cmd.exe	chcp.com
PID 1292 wrote to memory of 796	1292	cmd.exe	chcp.com
PID 1292 wrote to memory of 4884	1292	cmd.exe	netsh.exe
PID 1292 wrote to memory of 4884	1292	cmd.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\IpCam Bruter.exe
"C:\Users\Admin\AppData\Local\Temp\IpCam Bruter.exe"
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3728
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3972
- - C:\Windows\system32\findstr.exe
    findstr All
    3⤵
    PID:2312
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:796
- - C:\Windows\system32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Wi-Fi Discovery

1

T1016.002

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\600dd6cb2777db0d0006a90a60ad1538\Admin@HVDPCYGS_en-US\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\600dd6cb2777db0d0006a90a60ad1538\Admin@HVDPCYGS_en-US\System\Process.txt

Filesize
2KB

MD5
7bbfa24dfae7e67ac3bc754c4a8e6ef6

SHA1
7517653b9366459ffc2d3e1baed6e714745ff7c7

SHA256
05dac5bb840da04a803c75f5c5e6316891d2b8f2cf6075905d41ff6100bdfe2a

SHA512
2db53b9421e83f742ebbb985aae50e77179ca1c8fca299689d194a93ba4e022845ae7303cefa6887d7a01c653c1784e1533eaed90343e669b7edd6d3579d97da

Download Submit
C:\Users\Admin\AppData\Local\600dd6cb2777db0d0006a90a60ad1538\Admin@HVDPCYGS_en-US\System\Process.txt

Filesize
3KB

MD5
59d92d4e9b459d0cdca016c61e38301c

SHA1
7bf33b3816e04333920f73902f85d788daac95e7

SHA256
cb65585ffbbc76b5c9fc96eedfd5c69627dd2ce83d4d3547a24662aeba927d1c

SHA512
0a13004c7dde52c82e8b5ea7a8922f049f10304c0485b2449dba71013d3c1182419cb11b2027f3ed2092d509f75e73028337ff347cb46971666c818c3598e2bc

Download Submit
C:\Users\Admin\AppData\Local\600dd6cb2777db0d0006a90a60ad1538\Admin@HVDPCYGS_en-US\System\Process.txt

Filesize
4KB

MD5
7dda1fea268097bce0d9e4493ea60117

SHA1
0f301fc8924fe1aefcd111899679511a74659bd3

SHA256
c8b64366cbcf47f2875b7e766bc128e54d533e770237c7a5ea8ee2bb54df8c6e

SHA512
1f723c9da929290213517c88d82e15a1153838efd603c22eebb3118ff0b1657ea51cf05b022fcabf783b8c8c3b51ebfd01ac05d03fa9cfa94fdd7884d122b285

Download Submit
C:\Users\Admin\AppData\Local\600dd6cb2777db0d0006a90a60ad1538\Admin@HVDPCYGS_en-US\System\Process.txt

Filesize
743B

MD5
d73345686abf0fdb7ded3561d595b889

SHA1
8ecb50aba249e6b30e51c131de790eb1a04152ce

SHA256
f6247a5fc8d240ed0e9d5a57364d28c8b97f92d670e68500ca9761283e3c2e54

SHA512
9c628e087c0e899eda1ee6b195df2ca2147ad4110a15a86f6af0abb96ce2add9f28e47edac8c4d26e2fcc9e44ae9c4462fa2053b07ba2475dd3f66d9ba29d374

Download Submit
C:\Users\Admin\AppData\Local\600dd6cb2777db0d0006a90a60ad1538\Admin@HVDPCYGS_en-US\System\Process.txt

Filesize
1KB

MD5
ea0243f949fd45ffb042db3bcb88cf0f

SHA1
021a96387d04c6f486e2d2c66c361678a1978dcd

SHA256
380aab3c4d57bf68ed7fcf0822651fbe1081335f96e2a9a105cd9f505a9d2efa

SHA512
b1603004e29740e84a6d0dd7129c0f82bbc782e172ed00e2d0dd5cef4a7d911d584c8d4c3812417dd9920934bec0e1fd4a27f18877f0aa3fd1b5fbf9c12b77a6

Download Submit
C:\Users\Admin\AppData\Local\600dd6cb2777db0d0006a90a60ad1538\Admin@HVDPCYGS_en-US\System\Process.txt

Filesize
2KB

MD5
4db0e235b9cf8e23991d41b4ccd56101

SHA1
56f20d440709bd3b346924740205bb4d4da21800

SHA256
c41c3ffa31fe5964e2efde83a05197e7e0a61262324d3a3440d49f9fd86b10d4

SHA512
344715acf912bb56a01e150d001891100e7c365b680b281f6953bbb2a48d39588137035f216343153d5001f06e6dbf5864f84823a218f229036b179f10010674

Download Submit
C:\Users\Admin\AppData\Local\600dd6cb2777db0d0006a90a60ad1538\msgid.dat

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
memory/4088-2-0x00007FFC10370000-0x00007FFC10E31000-memory.dmp

Filesize
10.8MB

Download
memory/4088-1-0x0000027F763B0000-0x0000027F763DA000-memory.dmp

Filesize
168KB

Download
memory/4088-0-0x00007FFC10373000-0x00007FFC10375000-memory.dmp

Filesize
8KB

Download
memory/4088-151-0x0000027F78DB0000-0x0000027F78DBA000-memory.dmp

Filesize
40KB

Download
memory/4088-152-0x0000027F79FE0000-0x0000027F79FF2000-memory.dmp

Filesize
72KB

Download
memory/4088-194-0x00007FFC10373000-0x00007FFC10375000-memory.dmp

Filesize
8KB

Download
memory/4088-195-0x00007FFC10370000-0x00007FFC10E31000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads