asyncrat | b01d928331e2b87a961b1a5953bc7dbb8d757c250f1343d731e3b6bb20591243

Sharing

Copy URL Twitter E-mail

General

Target
b01d928331e2b87a961b1a5953bc7dbb8d757c250f1343d731e3b6bb20591243
Size 3.5MB
Sample260719-3rr6msgx2k
SHA256 b01d928331e2b87a961b1a5953bc7dbb8d757c250f1343d731e3b6bb20591243
MD5 45c1abfb717e3ef5223be0bfc51df2de
SHA1 4c074ea54a1749bf1e387f611dea0d940deea803
SHA512 3d667f5ada9b62706be003ba42c4390177fc47c82d1d9fa9eaca36e36422e77b894f5ec92ad7a143b7494a5a4b43d6eb8af91cb54e78984bb6e8350df5c34546
SSDEEP 98304:UePnIk+fZcURguwJaPquzFJi0E3znjVxkC2b4VbD:LfIzRtguwgqo5E33wIVbD
TLSH
T12D0633972A964233C465CFF5F4B4FA66CC30DC0006B10EAFFFA2F959682A975816C61D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  b01d928331e2b87a961b1a5953bc7dbb8d757c250f1343d731e3b6bb20591243
- Size 3.5MB
- SHA256 b01d928331e2b87a961b1a5953bc7dbb8d757c250f1343d731e3b6bb20591243
- MD5 45c1abfb717e3ef5223be0bfc51df2de
- SHA1 4c074ea54a1749bf1e387f611dea0d940deea803
- SHA512 3d667f5ada9b62706be003ba42c4390177fc47c82d1d9fa9eaca36e36422e77b894f5ec92ad7a143b7494a5a4b43d6eb8af91cb54e78984bb6e8350df5c34546
- SSDEEP 98304:UePnIk+fZcURguwJaPquzFJi0E3znjVxkC2b4VbD:LfIzRtguwgqo5E33wIVbD
- TLSH
  T12D0633972A964233C465CFF5F4B4FA66CC30DC0006B10EAFFFA2F959682A975816C61D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution asyncrat stormkitty persistence rat stealer
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Family: StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $TEMP/Amenities.pub
- Size 58KB
- SHA256 4e5e43ec6b9f6c5837391c94d27bf31f806de5c66ae69cf6dc765fdb9354e662
- MD5 0a71e5a021a54a070c4c1a50abf101a7
- SHA1 6138668ada2d95c7b6e08b81b3f9ccb9f5247b35
- SHA512 4d32af74ebda994eb5e4056b3bf58e160dad4673548a1ac34322ac4caec71cca9cd96b323eda63cdfb1a627f6b43b8dc0095ec2294ec2159e4c786287569e580
- SSDEEP 1536:EnfXAHM4Cntyj7IfuP4OmdUfD4ux/IaQpvF:EnfwH9Cne/+UfD4uSaQz
- TLSH
  T11B43023651D2B8B7E0695168259BCFE42F123DC7AAB0990BDD4B4711F7E8D640F2027B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  $TEMP/Apartments.pub
- Size 89KB
- SHA256 36a1197973ca14a3b37631378354614601d8114fe55d662331ff36c635156dc2
- MD5 60ba658102cdcb57ee4b1f74f342c707
- SHA1 f6763e33c4aad91b20be3b8886b6e5bd91a99754
- SHA512 9489ac2166628096c8969ac77497ce49a8970ba7730204faa7518f3d4d9a3650aace6c3d5ac6cb8eca51402033fe174f808a209001f7380ae99f7a12dceadbe8
- SSDEEP 1536:r78mUL0c0T2a28uio3hFSW0SL5GozE7+H2m/v5gNCMcea5m4eSlbXFSpw3KYLHlI:r5C0aa6ktME9CyCMcH5XFSu3KkHMCV+V
- TLSH
  T1DE9302A46956D850B35FFEACC2039B57932D4E03196472C9DF5B126CE8CA84E1F3C84B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  $TEMP/Argentina.pub
- Size 79KB
- SHA256 4441e796466684cb54f423b1be5a43ee96536e0ebd2568d6c5f571dc263840b0
- MD5 4388c3487e7d1472a69229a5f0197ccc
- SHA1 777e7d36f0584de3cc65786d41608ca99ee4f620
- SHA512 27c5fd7958d9cb004df02dfe888e74842aa038c7ab623a37333a06e805fae911c4785d19e5d4dc9bc756f91d3617db3936036b4c3b23a1296f65607076f89108
- SSDEEP 1536:+HUBE8E3STTBwTSl7z5uuVDufNDuTkzg38IfTWZIjShIs8aVZ0Cpi:0U3E3ciT+zR65uo838IbWisZ0gi
- TLSH
  T146830219678EE6E1060270A9D803C88CCBE955E65F9DB349680D9E0B1C9EB33C6C177A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  $TEMP/Comparison.pub
- Size 51KB
- SHA256 ff9fa6049de4b67aa3ffe200eae66f228ccf3f80c14b72941eaa7e60264b0536
- MD5 f9b4ba8289a774e8fe971eb05b6c3e73
- SHA1 64bcae2258089c7227ccba400b81c12572082d17
- SHA512 a192ca35449e85eefac0f553a8c0b9db109756328e4dbef297a1a80a6b001130fbf4544daaf487ee979ff53b98cadc0e0e194567111e71ed1d1e75b6b542c9f5
- SSDEEP 1536:6jvPyWAZTf06qic2rG6RZ9UvXT1+fqE1H8bEeUJL67F9Lsulyh:gyf0gRTResfnHR67FCulyh
- TLSH
  T12E33F2AC8BC8EC5DD3FD92FDA1F009A58944D0B8A6890311883F58915AB5CBFBD439D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  $TEMP/Confusion.pub
- Size 78KB
- SHA256 288b1f4c716dfb1b821171f03a5e6e4f35953bc2abe08c15d9393728e9a06257
- MD5 2785affd81c3e073c43df32ed2d00c9c
- SHA1 5d6a06caae5024543cf475d3e3027c594d9f4c7c
- SHA512 0472edb1f3114ff723c55edcdffc2b009a875e226ca69ce242edaa73512b7a0e81aaf3f5df08d18a8775a3fbf6f3a90df801e7f692f91e48d5bbe99a2bd45fb0
- SSDEEP 1536:yZo+FdZWRHGQjdRD63L8wkWUpPT3ESvDESyr4JCRBl3:yZPdQRHr5s3ww47U4S48RH
- TLSH
  T1FE731291CDDBA8C9CAD34574823688BED240B6716601229F28ED3EB8FD903457FA585F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  $TEMP/Distinguished.pub
- Size 87KB
- SHA256 df111febac27dff5d441df546576d1f63e55047c537c8eff0bb44c15f7c8c53d
- MD5 e600cbe70466c2341db84a36284c9774
- SHA1 093d93c67e982e7f56baddb25fcb6534f0e1a745
- SHA512 46be8f5cdc7e8d99b34b3c100b5f88f3d796b92a693b3a56d6dbb87e7c5a77c25a45f53ebe5c37cfd4e3d360319d342fd29d79fb5a334759423ee6ed37628f3a
- SSDEEP 1536:AJu933aYnmInoQMypgIZR5mRYR/+jRtRvWm4J2JWR4gX/a/hmPb7KQ9NdTf:AJu93znmosc1/mGRcRtJd4J2JQ/a/hmb
- TLSH
  T16B930235B40539FCA3BF36744F4AB22787E528F1D2499EA14972DF4ADFA1EB0126B140
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  $TEMP/Document.pub
- Size 61KB
- SHA256 224930c54c57e8fe9aeee19de1ac0799ad05b9014e3034ee2cefa5272d68d0be
- MD5 3152606654339510628be876ad7ab86c
- SHA1 3ea3a43c84d2a8cc02e802f0f002ad0f7ecfacb4
- SHA512 d0f427f0e8a76f3e751e3452c3db07a39cadc309958cfe49b06504f511f6d92287513e13a4bfb1859e193a8caffb7917372698b374900ef53c4e666c668edf90
- SSDEEP 1536:ArOqszXn/tv4NmYb+csVEmp9qS6wPWC/mvxXV3PvtM:BqszXn//c+cAE0+wPWCulJP+
- TLSH
  T171530106F7470175A2FF20D5395BD3F58AA798D951486BB06960C70FB1CCFA180B82AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  $TEMP/Enlarge.pub
- Size 78KB
- SHA256 f9f60c1dec818764c8838a2be6f60327c55aebcfff9329af931f191001a051da
- MD5 1f5b8234b3d731ec3efa6877d15c7b8c
- SHA1 60b59ff72eff1c340faeda29830ae168bd253495
- SHA512 a65b95297601eecbd6ff11db4d26090ba7895062f04a30bca621b3b886882d17e8d57630f681fe7b9bf1e01d03b8c24d012ff0d5694a0f65e83d3ae7ed891953
- SSDEEP 1536:/cMCFEx3s5N39fq0TgIHMzXi/9DDijA9gMgZ3e/zJKE7Z5iBdt4+5T4eR:/cAsf39fB0Xz29DngMgZ+lLMtfT4eR
- TLSH
  T1457302CAE63B044048313BCDA5A5F5225D34E74F82D1BF77F5B905B223222665D4FDA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  $TEMP/Explicitly.pub
- Size 56KB
- SHA256 dcd46e5e62353b800403fa27952d4d0fa91e097d12cfffebb134a8794ef560d1
- MD5 a27bce3c4fcffcec9e54b9373111d877
- SHA1 8813684c93bec16ef48c6c66b831cc91bafdf234
- SHA512 04c0b45afb353f4c4d3ec914c79f225d9a678142aec9d0b61954904380ac2ff5ab71da63035f811bfe349cb2cfb51029c979c5879de0bb7050237542214a623a
- SSDEEP 768:gRMUlp4NB2FrYODKuI6S6V+L8WFGTZKPQHA/DaCHZ5cGLh8TmoJq8z0bS/nGT9g/:gR7lEEmuh+L8RIkA7JLqyoJq80XTin/
- TLSH
  T1464302BD8CED6363EC36CA566269B50926E26F0DC7421663F7BBD0D368C368ED40D504
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  $TEMP/Gate.pub
- Size 56KB
- SHA256 7bf9529b155b898532c530311215633371f6d24f0fde35a18d91cee7f498e5a6
- MD5 6401d7e0a9d7799cc1ecaee55e6482d6
- SHA1 55d93e5275c34d44c7940a3cd6dbc170b4d2a799
- SHA512 ec66f36f054043aa95e42144c3faea771bbccec912a92828e293e98c4fb219edbfbcdf4ddcafdf62322207e50a4189a4338de8e95380049c3d35bcc28fb0e981
- SSDEEP 1536:spF6aFFCNkBYEEcGnzGRq83yHkEx4o64yW+5tekarblgFLU2X:sKaONkBYEQnziqPHkEstelrbeY2X
- TLSH
  T1E04301F25ED81FE8F81E912E8D5E6BC0F1310453E9BFF5CA964AE04599A1963306107B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  $TEMP/Generating.pub
- Size 81KB
- SHA256 b8af578b7388ab44441b859780987b962457297b0f583d0fdd9329c69b68c107
- MD5 75caffb2a658b3dc3fda54c8b830e255
- SHA1 891b1afaceaedeca1275dcb480eb4383b895eeb5
- SHA512 b75dfd7de87cde8d0b2863ba16d2f23cf4883418842598786f73930c7ac0e6648e122200b8f820cc89f953e546678358a4af13849a299c5466cbabc6c7c99c93
- SSDEEP 1536:MGadYRT6n8GSM4fCF28aMbPc3CJ6NkvYDjYTZM42WCFMour2e:MGQsTvG2fCUMbU3CJ6S0jYToWCQr2e
- TLSH
  T19E8312EE07015AD42D534201543DA3EB33AECC59F714CED634269E34B9BD269923EEB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  $TEMP/Governor.pub
- Size 84KB
- SHA256 6ce95bb839c41ddecbbcd95484471674573f54bcc431351202eb10f7430251c9
- MD5 c35f290c55dc153aa53b0fca79a20482
- SHA1 b70cac04f88f880842cc4a54ccbb25c6b00a0ebc
- SHA512 11a9c8c048bd400797db792b3eabf4a5dbdd9910648fd4ed632523941db6fdcefe1a4b7a5e89fae839795f158fcb31dad70b78418f0ca06723b5a3678c0cb4ff
- SSDEEP 1536:BxFgGBXG79JwQInzD87x7ZDufC7Kgx7EAFK8Yv70B:BBWIzc7QIKg2AFK8Mq
- TLSH
  T1968302535EDDD01E4E879667F1CA03730658B6B4DA71FC062A2F22A5C4A6E13E820D67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  $TEMP/Legislation.pub
- Size 79KB
- SHA256 f550e56fa09560678c99a8c171552e7aed6bcbc26d4b7b95d50851b8ef4fa8fa
- MD5 63d8544a82d12a57c54c313d993c85bf
- SHA1 976aef6a762f3e74592cc134aacb3bc9b45f5a75
- SHA512 666694b83475b9a287e61cd0fdfb5bf4ed2e1a65ad774fe9402527ee4511c41da7b97231be6bcfa3a96251bf4b81f93157375f63bfe32c61ff9c35ec7df1eeed
- SSDEEP 1536:r6O2fL0fUbuyQrLUqrMDgikMDGqQrTETfOFmHh22ts:r6O2fLzbvQrwYMDgikMywyFm4f
- TLSH
  T19283131661559754E05523F3DD8E02078CF2CFBA93198F54B4EA8B6AA47ED2DF30AC83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  $TEMP/Listening.pub
- Size 63KB
- SHA256 b43f6bb3e55105d2cd9745fa2bb40449024896b314460f686650ba6fcb82e328
- MD5 a20a1ed37a395a59924f82ebe8925d75
- SHA1 888266575b1719e9b651fc3b778145f0539871a8
- SHA512 3317a8080c5b759b485c50630ac2ce3eee964430acf4afa714cd364d659822877d3e598cc3ab4db878c0ae20f1f84f23b31d02e6409ca6053cbbaebf69b5df5a
- SSDEEP 1536:6iy5E2dm5qkQ21ih916zSsLvvfsdGKUkGVppkVNJC1b6PyZ6:ByzMqkQ2MozSsLvvfS5UkYHk81+
- TLSH
  T19853023F43D26990B7E492AF7C7034A76DC147B00364B1DE916B13CAF099EA14A8B7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  $TEMP/Maintains.pub
- Size 98KB
- SHA256 82f2723cfdc19e16c28300632ab3fc560e38321afe406bbc4735a8dd37d7ef30
- MD5 dbc26e8b9f547df6511f2c07d206d2ef
- SHA1 b12900963f7b93da5944e104a86d4a6b7137be60
- SHA512 1325e49ed2e64dc68a6f342443dccfe6b83aba26d8a1f35c7c7d87802d696f2c68f618cc366592bd014a716318e3b85f7986282999445fac9ca8349bf66b8df5
- SSDEEP 1536:fBntJgPw5E7hZ7iOhLOIuoEocY3o2brwbKGCfyI4lUuPBp/8GfrZEofCulva:fBp5E7v7LdEojbrwGGjIxYtXrZEoi
- TLSH
  T12FA312720C6DFBE061A406190DEAF48524FE4FE5F496ED0083C4D5E24AB73B5DB196D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: AsyncRat

Family: StormKitty

StormKitty payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Checks computer location settings

Drops startup file

Executes dropped EXE

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32