asyncrat | 13a1264ffcc8e8ed54f849db376330ca634c3312dd1ac12e7244f6705024eaa2

Analysis

max time kernel
15s
max time network
18s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
24-09-2022 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Account Generator.exe
Size

65KB
MD5

8bfd2d2247e575781c69af466e7a72c2
SHA1

2c0a8f286513e81fee033f2c626bf56c6099225f
SHA256

5c3c584dac464e1ca4d38234e1178cd668cbfddc316485b9ef043057ce23f436
SHA512

a9d2eb3308587000b6539aee95c77cb8e2fb56a3b426d8d862932c7a266c7b9796d239057043971218784c36dffe3a7d603596003bf2311c15c48959afb1662b
SSDEEP

1536:jn1v8Ywnx3z66wEs9Dm+sl1bbsoxvom7M+asANpqKmY7:jnVwnx3zRwEI7K1bbsoLMKAWz

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

VenomRAT_HVNC 5.0.4

Botnet

Venom Clients

192.168.1.167:8080

Mutex

uJcmfciqm

Attributes

delay
0
install
true
install_file
MicroSoftHealthTool.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2672-116-0x00000000006C0000-0x00000000006D6000-memory.dmp	asyncrat

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3636 2672 WerFault.exe Account Generator.exe

pid	pid_target	process	target process
3636	2672	WerFault.exe	Account Generator.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

Account Generator.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2672	Account Generator.exe
Token: SeSecurityPrivilege	2672	Account Generator.exe
Token: SeTakeOwnershipPrivilege	2672	Account Generator.exe
Token: SeLoadDriverPrivilege	2672	Account Generator.exe
Token: SeSystemProfilePrivilege	2672	Account Generator.exe
Token: SeSystemtimePrivilege	2672	Account Generator.exe
Token: SeProfSingleProcessPrivilege	2672	Account Generator.exe
Token: SeIncBasePriorityPrivilege	2672	Account Generator.exe
Token: SeCreatePagefilePrivilege	2672	Account Generator.exe
Token: SeBackupPrivilege	2672	Account Generator.exe
Token: SeRestorePrivilege	2672	Account Generator.exe
Token: SeShutdownPrivilege	2672	Account Generator.exe
Token: SeDebugPrivilege	2672	Account Generator.exe
Token: SeSystemEnvironmentPrivilege	2672	Account Generator.exe
Token: SeRemoteShutdownPrivilege	2672	Account Generator.exe
Token: SeUndockPrivilege	2672	Account Generator.exe
Token: SeManageVolumePrivilege	2672	Account Generator.exe
Token: 33	2672	Account Generator.exe
Token: 34	2672	Account Generator.exe
Token: 35	2672	Account Generator.exe
Token: 36	2672	Account Generator.exe

C:\Users\Admin\AppData\Local\Temp\Account Generator.exe
"C:\Users\Admin\AppData\Local\Temp\Account Generator.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2672 -s 988
2⤵
- Program crash
PID:3636

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2672-116-0x00000000006C0000-0x00000000006D6000-memory.dmp

Filesize
88KB

Download