Analysis
-
max time kernel
899s -
max time network
441s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-01-2025 01:01
General
-
Target
6c0f0e572cc778c48fd9f7e933ff9074b77228073245504f55170fb7f89bec94.exe
-
Size
233KB
-
MD5
3ae4d230b70fe627b578cec30d650733
-
SHA1
3ba4c86e93be24bb289d7936012547cc76e74b5d
-
SHA256
6c0f0e572cc778c48fd9f7e933ff9074b77228073245504f55170fb7f89bec94
-
SHA512
062adeba5c336d23799b4ff2a3cf99715dbc604a621047a99afb4e81b05f07bd96d0cd25690ba3ce9f69bd6310c8321f4e7b5fd1be4a6e77794c59d1c6352dc4
-
SSDEEP
6144:oDubaBBOBIIj6HLLYLCYJqvc1DQw3k+jjLb/8Hbxbs5VnzHI:Bbarw3kMb0lb4V
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7510964527:AAGdCh-pkbTYHGH3dVQA167HKQ6_6_J6-Bg/sendMessage?chat_id=7551483138
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 9 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c0f0e572cc778c48fd9f7e933ff9074b77228073245504f55170fb7f89bec94.exeC:\Users\Admin\AppData\Local\Temp\6c0f0e572cc778c48fd9f7e933ff9074b77228073245504f55170fb7f89bec94.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\AppData\Local\Temp\6c0f0e572cc778c48fd9f7e933ff9074b77228073245504f55170fb7f89bec94.exe"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5b03cf602209185ac1ff97ff6f7e6144d
SHA1dcc6c58817988a4fc7d5afa41de5b1c5e3c82c66
SHA25666bf64b1504d0938e2e970c36ea99e6f41d05c3197f24073af2766015eae5e36
SHA512d2268223dd6a1f9b47bf742c932ad3b78cd139d04752b2d9832fa1f13007d0ee8edd54c4df6cb839340a25e1e04cb92587d6a38b4b0cfe4384d6f6c04adc5b6e
-
Filesize
4B
MD55a9d8bf5b7a4b35f3110dde8673bdda2
SHA195ad137911a723d1df6118522ab29da20e4cbfb4
SHA256e1fe15b6ce5ddcc2725b40708ff51d576ac59715278d9e590e7ec23a37b360ed
SHA51228994bcd638fa8b261e57cc4bd8a02f28958c8995747496b8c5f6a44764a3f2a08a14e1797dac83d21dfefaf8bebe32eb007837b9f83f302c218805ac8888574
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
256KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
40KB