asyncrat | 5e8a676a5b37f85a09339873a139a73268662b1c0bfe94d764bbfffec60ea196

General

Target

iubn.ps1
Size

1KB
MD5

1ec2c58c17fc606446451058a6961972
SHA1

abfd1b16246bcce8721d2c5aa85cfa354135f2ff
SHA256

5e8a676a5b37f85a09339873a139a73268662b1c0bfe94d764bbfffec60ea196
SHA512

7365d26c3b74e25d18618d3042ff98fedae2d1e5db6f2c6d0a7034582141a78e5c2df949477c1169e471ced3fcf94d660b7cd8655ecd6bda2d803f1ecc0c0f17

Score

10^/10

asyncrat stormkitty discovery execution rat stealer

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/2248-28-0x0000000000400000-0x0000000000704000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	4380	powershell.exe

Downloads MZ/PE file
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4380 set thread context of 2248	4380	powershell.exe	87

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4380	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4380	powershell.exe
4380	powershell.exe
2248	RegAsm.exe
2248	RegAsm.exe
2248	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	2248	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2248	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 4252	4380	powershell.exe	84
PID 4380 wrote to memory of 4252	4380	powershell.exe	84
PID 4252 wrote to memory of 848	4252	csc.exe	85
PID 4252 wrote to memory of 848	4252	csc.exe	85
PID 4380 wrote to memory of 2248	4380	powershell.exe	87
PID 4380 wrote to memory of 2248	4380	powershell.exe	87
PID 4380 wrote to memory of 2248	4380	powershell.exe	87
PID 4380 wrote to memory of 2248	4380	powershell.exe	87
PID 4380 wrote to memory of 2248	4380	powershell.exe	87
PID 4380 wrote to memory of 2248	4380	powershell.exe	87
PID 4380 wrote to memory of 2248	4380	powershell.exe	87
PID 4380 wrote to memory of 2248	4380	powershell.exe	87

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\iubn.ps1
1⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\20sojpzm\20sojpzm.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA72D.tmp" "c:\Users\Admin\AppData\Local\Temp\20sojpzm\CSCFFE2AB88834B406492E23418DF5E7F.TMP"
    3⤵
    PID:848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\20sojpzm\20sojpzm.dll

Filesize
9KB

MD5
423f855de859c08bfdc2e44a040b4b1b

SHA1
a440591056cb6a6e5d0f39abcc814454355af1b1

SHA256
73efa038c287b74b64c34ef167ec5d19eefde48df7c6f78b072bc1e062786a8b

SHA512
dbe9689433a1a996d21368fe2ad060b19d3a2410633109c32b0372d0d9d373b9f121ae34e7ce8b27d76c08876a590529ce5850d05902fbd008b1c2b444933b61

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA72D.tmp

Filesize
1KB

MD5
6955c01b6e54bf51f487f07d6e0e1dab

SHA1
0e628dcb3006424c9e84c7d38f9cb9bf4ddd69b4

SHA256
9982112a516cf6cb91b44af35395e1235d7de4140ad190b4da308df0f6aeb5c1

SHA512
6c3950b68c945f07f963aeef841283b766d912dc03c55cd8c4bfb501a4f8a4982b3729b2ff5d8f81bc62d6155319fe76a596836ea07be74e97a8d1e7d1282e94

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ei53b2px.vky.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\20sojpzm\20sojpzm.0.cs

Filesize
10KB

MD5
3fa79decff8805745cea8116d9bb2643

SHA1
92343c5fa2c768b964ae3a4e9136e5d7193e8558

SHA256
e6852a401b53a7af04d57aa1e4fc9621e3dffc1221534142316a27ae67e8f89c

SHA512
5c2879e59fa6609e6e87f70c5237b250a906bf7dd13a343dac9e81635b1fc91ad9374e643a306b99503c52ce9bd56554a64aa132584c732d43ee39fb17305d78

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\20sojpzm\20sojpzm.cmdline

Filesize
204B

MD5
6c0dd262606d4003f786172225018489

SHA1
623fbaf3070af69290f9a93bb91f9e7bd3b9bab1

SHA256
162a80624a8dfddbf8791dff3009ee296b5ac702810e94a6bcbc49134d5dc331

SHA512
0a38aab55412e66aaf7139a8c17ce20dfbaae587199ed912d11eec26e456013310ab5f320319614564d3ca615d0eaa76eb431b6ad285fcaf7316c7cc83456ee4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\20sojpzm\CSCFFE2AB88834B406492E23418DF5E7F.TMP

Filesize
652B

MD5
b0b15386b056c0ef8c2441cceba59af1

SHA1
fc191480ff56f0cf138f2b17c092f2dd253420e2

SHA256
265f21627b3fcfff686272ac5250432dd1a33d0c3bdcf91bcc7990e746fd4dca

SHA512
d09085d56b354eef252c3b040450b003f8f2afc8f9ab9a5bcea65116b4f4dfc2277458ff12a60050827763e7b41daab09869cc1026c5811082e29e1549dd28bf

Download Submit
memory/2248-40-0x0000000007070000-0x00000000073C4000-memory.dmp

Filesize
3.3MB

Download
memory/2248-39-0x0000000007040000-0x0000000007062000-memory.dmp

Filesize
136KB

Download
memory/2248-34-0x0000000005CB0000-0x0000000005CBA000-memory.dmp

Filesize
40KB

Download
memory/2248-41-0x0000000007BF0000-0x0000000007C66000-memory.dmp

Filesize
472KB

Download
memory/2248-38-0x00000000068C0000-0x0000000006926000-memory.dmp

Filesize
408KB

Download
memory/2248-42-0x0000000007CA0000-0x0000000007CBE000-memory.dmp

Filesize
120KB

Download
memory/2248-28-0x0000000000400000-0x0000000000704000-memory.dmp

Filesize
3.0MB

Download
memory/2248-37-0x0000000006C90000-0x0000000006D2C000-memory.dmp

Filesize
624KB

Download
memory/2248-32-0x0000000005DF0000-0x0000000006394000-memory.dmp

Filesize
5.6MB

Download
memory/2248-33-0x0000000005D10000-0x0000000005DA2000-memory.dmp

Filesize
584KB

Download
memory/4380-13-0x000002A053280000-0x000002A05328E000-memory.dmp

Filesize
56KB

Download
memory/4380-31-0x00007FFB497F0000-0x00007FFB4A2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4380-26-0x000002A06D9C0000-0x000002A06D9C8000-memory.dmp

Filesize
32KB

Download
memory/4380-0-0x00007FFB497F3000-0x00007FFB497F5000-memory.dmp

Filesize
8KB

Download
memory/4380-12-0x00007FFB497F0000-0x00007FFB4A2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4380-11-0x00007FFB497F0000-0x00007FFB4A2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4380-1-0x000002A06B7F0000-0x000002A06B812000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing