asyncrat | 0f80bb8d09855e63b1c7ee2b16831885827c255e757d73106791d09ec3fd94f1

General

Target

5.exe
Size

1.8MB
MD5

8c9c35191068974382d0637e4ef4af43
SHA1

a00ac4856e32c4a836d6ca050ddaf745de8cee61
SHA256

0f80bb8d09855e63b1c7ee2b16831885827c255e757d73106791d09ec3fd94f1
SHA512

610502b61500c1ecbeb6539a1b60fd4009b777029233b0a80453ee93ce1b6b286f944a0dc1bbad1665eceb8a33ca6ea2a2e2ca54d0fb4c6745b71ef03fcdb50f
SSDEEP

49152:n2EYTb8atv1orq+pEiSDTj1VyvBa44yHdBvAnOx30KlhY33lSYHEz/N:2XbIrqabvAn043UYH

Score

10^/10

asyncrat stormkitty default discovery execution rat spyware stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://www.montereal.com.pe/INV3294331887.txt

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

91.92.240.191:4449

91.92.240.191:2025

Mutex

xpexpmibjcreztb

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2808-43-0x0000000007550000-0x0000000007672000-memory.dmp	family_stormkitty

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

InformationCheck.exe

description	pid	process	target process
PID 3268 created 3420	3268	InformationCheck.exe	Explorer.EXE
PID 3268 created 3420	3268	InformationCheck.exe	Explorer.EXE

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

8 3572 powershell.exe

flow	pid	process
8	3572	powershell.exe

Drops startup file 2 IoCs

Processes:

cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url	cmd.exe

Executes dropped EXE 2 IoCs

Processes:

InformationCheck.exejsc.exe

pid process

3268 InformationCheck.exe
2808 jsc.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

3572 powershell.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4364 2808 WerFault.exe jsc.exe

pid	process
3268	InformationCheck.exe
2808	jsc.exe

pid	pid_target	process	target process
4364	2808	WerFault.exe	jsc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

InformationCheck.execmd.exejsc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InformationCheck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

powershell.exeInformationCheck.exejsc.exe

pid	process
3572	powershell.exe
3572	powershell.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
2808	jsc.exe
2808	jsc.exe
2808	jsc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exejsc.exe

description pid process

Token: SeDebugPrivilege 3572 powershell.exe
Token: SeDebugPrivilege 2808 jsc.exe
Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

5.exeInformationCheck.exe

pid process

2092 5.exe
2092 5.exe
2092 5.exe
3268 InformationCheck.exe
3268 InformationCheck.exe
3268 InformationCheck.exe
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

5.exeInformationCheck.exe

pid process

2092 5.exe
2092 5.exe
2092 5.exe
3268 InformationCheck.exe
3268 InformationCheck.exe
3268 InformationCheck.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

jsc.exe

pid process

2808 jsc.exe

description	pid	process
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeDebugPrivilege	2808	jsc.exe

pid	process
2092	5.exe
2092	5.exe
2092	5.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe

pid	process
2092	5.exe
2092	5.exe
2092	5.exe
3268	InformationCheck.exe
3268	InformationCheck.exe
3268	InformationCheck.exe

pid	process
2808	jsc.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

5.exepowershell.exeInformationCheck.exe

description	pid	process	target process
PID 2092 wrote to memory of 3572	2092	5.exe	powershell.exe
PID 2092 wrote to memory of 3572	2092	5.exe	powershell.exe
PID 3572 wrote to memory of 3268	3572	powershell.exe	InformationCheck.exe
PID 3572 wrote to memory of 3268	3572	powershell.exe	InformationCheck.exe
PID 3572 wrote to memory of 3268	3572	powershell.exe	InformationCheck.exe
PID 3268 wrote to memory of 1644	3268	InformationCheck.exe	cmd.exe
PID 3268 wrote to memory of 1644	3268	InformationCheck.exe	cmd.exe
PID 3268 wrote to memory of 1644	3268	InformationCheck.exe	cmd.exe
PID 3268 wrote to memory of 2808	3268	InformationCheck.exe	jsc.exe
PID 3268 wrote to memory of 2808	3268	InformationCheck.exe	jsc.exe
PID 3268 wrote to memory of 2808	3268	InformationCheck.exe	jsc.exe
PID 3268 wrote to memory of 2808	3268	InformationCheck.exe	jsc.exe
PID 3268 wrote to memory of 2808	3268	InformationCheck.exe	jsc.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3420
- C:\Users\Admin\AppData\Local\Temp\5.exe
  "C:\Users\Admin\AppData\Local\Temp\5.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Users\Public\InformationCheck.exe
      "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3268
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\Admin\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:1644
- C:\Users\Public\jsc.exe
  C:\Users\Public\jsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 2668
    3⤵
    - Program crash
    PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2808 -ip 2808
1⤵
PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

Query Registry

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g0ybpi04.grk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Public\Details.au3

Filesize
601KB

MD5
8eaea60d1eb77ebc53e44e5506cf4348

SHA1
117da9c06499ecefd0f3a91a329898b82b5bdddd

SHA256
e91b5b7ac286e3ad45ed7a57efacf213ff53f2e05f109ee2f51bdf13058c1c62

SHA512
3a853e5b074f1e9fa66f8bcfc251c11c686ff64b2286974598117b07633be0de13d676c7271e6698067e1d691c049122235c455243ab4d919baf6d99aaad14a5

Download Submit
C:\Users\Public\InformationCheck.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Public\ProfileDetails.ps1

Filesize
364B

MD5
0cc5e7e35db2204d53ad52913b645af0

SHA1
e294ed13495927b62330dcca1afe494eb4cfbcf8

SHA256
addf80e2d85e1146cd03112702ee0a2ed38ebb6283da4bddff3f748763b8459b

SHA512
6ef17a91aa209f43c09209abb55ddd6b8b81e445cf212cba97a1858652790f666e2140f987f3599a1c86f36df55c30d7fa1bfbc1cf402b0eacf2c8cc689a5e15

Download Submit
C:\Users\Public\jsc.exe

Filesize
46KB

MD5
94c8e57a80dfca2482dedb87b93d4fd9

SHA1
5729e6c7d2f5ab760f0093b9d44f8ac0f876a803

SHA256
39e87f0edcdd15582cfefdfab1975aadd2c7ca1e3a5f07b1146ce3206f401bb5

SHA512
1798a3607b2b94732b52de51d2748c86f9453343b6d8a417e98e65ddb38e9198cdcb2f45bf60823cb429b312466b28c5103c7588f2c4ef69fa27bfdb4f4c67dc

Download Submit
memory/2808-36-0x0000000005550000-0x000000000555A000-memory.dmp

Filesize
40KB

Download
memory/2808-40-0x0000000006510000-0x0000000006576000-memory.dmp

Filesize
408KB

Download
memory/2808-69-0x0000000007790000-0x00000000077DC000-memory.dmp

Filesize
304KB

Download
memory/2808-68-0x0000000007A90000-0x0000000007DE4000-memory.dmp

Filesize
3.3MB

Download
memory/2808-44-0x00000000074B0000-0x00000000074CE000-memory.dmp

Filesize
120KB

Download
memory/2808-43-0x0000000007550000-0x0000000007672000-memory.dmp

Filesize
1.1MB

Download
memory/2808-42-0x00000000074D0000-0x0000000007546000-memory.dmp

Filesize
472KB

Download
memory/2808-33-0x0000000005B60000-0x0000000006104000-memory.dmp

Filesize
5.6MB

Download
memory/2808-30-0x0000000000D70000-0x0000000000D88000-memory.dmp

Filesize
96KB

Download
memory/2808-39-0x0000000006B50000-0x0000000006BEC000-memory.dmp

Filesize
624KB

Download
memory/2808-35-0x0000000005850000-0x00000000058E2000-memory.dmp

Filesize
584KB

Download
memory/3572-13-0x00007FFD766D0000-0x00007FFD77191000-memory.dmp

Filesize
10.8MB

Download
memory/3572-2-0x00007FFD766D3000-0x00007FFD766D5000-memory.dmp

Filesize
8KB

Download
memory/3572-14-0x00007FFD766D0000-0x00007FFD77191000-memory.dmp

Filesize
10.8MB

Download
memory/3572-12-0x000001C8E01B0000-0x000001C8E01D2000-memory.dmp

Filesize
136KB

Download
memory/3572-21-0x00007FFD766D0000-0x00007FFD77191000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads