asyncrat | 6c13935ce459215baf7b863cf206747125cacca60793e81ca06ee66139eeba79

General

Target

vbc.exe
Size

455KB
MD5

f383aca77ec8694ab609f6c6ee464bde
SHA1

836abb931164edf8ea1ec1437b94eed0fc568049
SHA256

6c13935ce459215baf7b863cf206747125cacca60793e81ca06ee66139eeba79
SHA512

7acba871babb6cba09d1e444387d4d282f65b951b16127145521cd70915995425de6efc72a5f6400c81371734e5a47eaa33ed76ce06586f45fc8df1108af4040

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

194.5.97.88:5050

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3600-140-0x00000000003D0000-0x00000000003E6000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
3600	InstallUtil.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4840 set thread context of 3600	4840	vbc.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4840	vbc.exe
4840	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	vbc.exe
Token: SeDebugPrivilege	3600	InstallUtil.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 3600	4840	vbc.exe	82
PID 4840 wrote to memory of 3600	4840	vbc.exe	82
PID 4840 wrote to memory of 3600	4840	vbc.exe	82
PID 4840 wrote to memory of 3600	4840	vbc.exe	82
PID 4840 wrote to memory of 3600	4840	vbc.exe	82
PID 4840 wrote to memory of 3600	4840	vbc.exe	82
PID 4840 wrote to memory of 3600	4840	vbc.exe	82
PID 4840 wrote to memory of 3600	4840	vbc.exe	82

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe

Filesize
41KB

MD5
5d4073b2eb6d217c19f2b22f21bf8d57

SHA1
f0209900fbf08d004b886a0b3ba33ea2b0bf9da8

SHA256
ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3

SHA512
9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe

Filesize
41KB

MD5
5d4073b2eb6d217c19f2b22f21bf8d57

SHA1
f0209900fbf08d004b886a0b3ba33ea2b0bf9da8

SHA256
ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3

SHA512
9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159

Download Submit
memory/3600-140-0x00000000003D0000-0x00000000003E6000-memory.dmp

Filesize
88KB

Download
memory/4840-130-0x0000000000A80000-0x0000000000AF6000-memory.dmp

Filesize
472KB

Download
memory/4840-131-0x0000000005AD0000-0x0000000006074000-memory.dmp

Filesize
5.6MB

Download
memory/4840-132-0x0000000005520000-0x00000000055B2000-memory.dmp

Filesize
584KB

Download
memory/4840-133-0x00000000055C0000-0x000000000565C000-memory.dmp

Filesize
624KB

Download
memory/4840-134-0x0000000006430000-0x000000000643A000-memory.dmp

Filesize
40KB

Download
memory/4840-135-0x000000000E1A0000-0x000000000E1C2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing