Analysis
-
max time kernel
143s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
31/03/2025, 10:45
General
-
Target
2025-03-31_4ccb0b694056ee88f0c620568d2db2fb_black-basta_cobalt-strike_satacom.exe
-
Size
967KB
-
MD5
4ccb0b694056ee88f0c620568d2db2fb
-
SHA1
dd6deb3cdcd9526f9f9f4d9070a4bb699b16b620
-
SHA256
96ad3c384af92598cddd954ce1b462de8a31e8e2b206a97bea5a6379d10059e7
-
SHA512
03a37a3affd371439cc719f74982f22e376d9cfd5f01fbf331dbe2977dc946f723c752b1c34f6f261433fae6e4f9a43525466f708d515b405927f0b439667472
-
SSDEEP
24576:aSsZR9MmylrGpYgpgEIUjKiZm6L3YR+K1y/xyU:aSsv2z4pYgpgEI0KiZLLoB1w
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7636279565:AAFfbV9wqzcTb1Fa4IkguermnQhZKwCqJSo/sendMessage?chat_id=7913121735
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Async RAT payload 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 8 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-31_4ccb0b694056ee88f0c620568d2db2fb_black-basta_cobalt-strike_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-31_4ccb0b694056ee88f0c620568d2db2fb_black-basta_cobalt-strike_satacom.exe"1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profile3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\findstr.exefindstr All3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
Filesize
3KB
MD5e91dad073ee44cf9c8665890263ccdba
SHA1ce4f10c3c257dd14d1398d5603c8ec5ada93abcc
SHA25605b8c32cbd9307b7c177242edc2ebb0ee18b9a0da0f34b2ff1df344f772193ba
SHA51265bdae7757dd9dafcb1875adba0712aca6125d0b0377cfab9571b578e526d4482a4b95d91ad3623838f0b9b742c5bf2490c4e488aef03437d2aa26ad14a853f9
-
Filesize
4KB
MD535d0821e6937b0f522ae9387192c85e5
SHA1d0aea83cbb3c75fdf6f5686ade7c7be8e9c89854
SHA2567f8ad279bf91b25a1a7086d0b4403474dc5d0f04c7608844baf3e55945bb2bda
SHA5120af2e0099230700e9f2043ce96aa1495f5c2cc6331ee58583946d91332243264a4e2ce442196095ce2692c1696b2cfcee0dee558c5153b2f468f17d07b6f2aa4
-
Filesize
2KB
MD500bda6efda797f06194b3239059936fc
SHA1d516c5f4b847e3e946e51e013fbfef0c5f025629
SHA2561729f8cc994a15a5585cf9bb26f3eac8fda62076eb5bdf6fa7bf7e41c34590fd
SHA512e95c2f2f595d67adf47fbdff53f473725c3375dc5c421062cb5a5df1ec64e9fd5a03f448a6cbb610fdac175447faaaca79ac72fde0885e30ee512ef845e8f827
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
200KB
-
Filesize
10.8MB
-
Filesize
208KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
10.8MB