Analysis
-
max time kernel
147s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 18:52
Behavioral task
behavioral1
Sample
bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe
Resource
win10v2004-20241007-en
General
-
Target
bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe
-
Size
167KB
-
MD5
2494ddf095f3ad52f3ce518c45e37815
-
SHA1
fef7060001121af7720efc877adb57b3a0770e6c
-
SHA256
bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec
-
SHA512
6b1f703c94dcb3b5d33f303dd18c633863f846beb51ce06c574a0030ba7d8e90d71b76893fcf71947186e53567fa8ba9c54cccdce8453610b93df31dad992bf8
-
SSDEEP
3072:Kiuo2wrg+t38kRKQ9pgEvGW2e861u/s9b2JtD1wZp+Wp+WIrk:Cwg+t3DgEvTV91Ss9bY7KdIr
Malware Config
Extracted
asyncrat
0.0.1
Default
bigdaddy-service.biz:6606
bigdaddy-service.biz:7707
bigdaddy-service.biz:8808
https://api.telegram.org/bot1887752763:AAEFHUQhXilkF7u0X0Uqs-Po7aZUCtVrohg/sendMessage?chat_id=1096425866
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral1/memory/2660-1-0x00000000000A0000-0x00000000000D0000-memory.dmp family_stormkitty -
Stormkitty family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\a41f4a45925bee118fdf4ea15e531c08\Admin@BCXRJFKE_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe File created C:\Users\Admin\AppData\Local\a41f4a45925bee118fdf4ea15e531c08\Admin@BCXRJFKE_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe File created C:\Users\Admin\AppData\Local\a41f4a45925bee118fdf4ea15e531c08\Admin@BCXRJFKE_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe File created C:\Users\Admin\AppData\Local\a41f4a45925bee118fdf4ea15e531c08\Admin@BCXRJFKE_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2924 cmd.exe 2612 netsh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2660 bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe 2660 bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe 2660 bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2660 bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2660 wrote to memory of 2924 2660 bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe 30 PID 2660 wrote to memory of 2924 2660 bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe 30 PID 2660 wrote to memory of 2924 2660 bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe 30 PID 2660 wrote to memory of 2924 2660 bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe 30 PID 2924 wrote to memory of 2028 2924 cmd.exe 32 PID 2924 wrote to memory of 2028 2924 cmd.exe 32 PID 2924 wrote to memory of 2028 2924 cmd.exe 32 PID 2924 wrote to memory of 2028 2924 cmd.exe 32 PID 2924 wrote to memory of 2612 2924 cmd.exe 33 PID 2924 wrote to memory of 2612 2924 cmd.exe 33 PID 2924 wrote to memory of 2612 2924 cmd.exe 33 PID 2924 wrote to memory of 2612 2924 cmd.exe 33 PID 2924 wrote to memory of 2252 2924 cmd.exe 34 PID 2924 wrote to memory of 2252 2924 cmd.exe 34 PID 2924 wrote to memory of 2252 2924 cmd.exe 34 PID 2924 wrote to memory of 2252 2924 cmd.exe 34 PID 2660 wrote to memory of 1532 2660 bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe 35 PID 2660 wrote to memory of 1532 2660 bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe 35 PID 2660 wrote to memory of 1532 2660 bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe 35 PID 2660 wrote to memory of 1532 2660 bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe 35 PID 1532 wrote to memory of 2024 1532 cmd.exe 37 PID 1532 wrote to memory of 2024 1532 cmd.exe 37 PID 1532 wrote to memory of 2024 1532 cmd.exe 37 PID 1532 wrote to memory of 2024 1532 cmd.exe 37 PID 1532 wrote to memory of 1312 1532 cmd.exe 38 PID 1532 wrote to memory of 1312 1532 cmd.exe 38 PID 1532 wrote to memory of 1312 1532 cmd.exe 38 PID 1532 wrote to memory of 1312 1532 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe"C:\Users\Admin\AppData\Local\Temp\bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:2028
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2612
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
- System Location Discovery: System Language Discovery
PID:2252
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:2024
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1312
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\a41f4a45925bee118fdf4ea15e531c08\Admin@BCXRJFKE_en-US\Browsers\Firefox\Bookmarks.txt
Filesize105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99