asyncrat | e2f693427eb98ff14d97a66007433ddebb3a8311309e2b1f1a95a07c3ec397b4

General

Target

redfv.exe
Size

300.0MB
MD5

f2fe09806411a018f01bb6a12a80b2b2
SHA1

c08c933ff0bd50a1bded400f086378ddaab5ba4d
SHA256

e2f693427eb98ff14d97a66007433ddebb3a8311309e2b1f1a95a07c3ec397b4
SHA512

e435ef3941858b3e3a4d24bfd9778b9c683185472cdd326209dfdbfdc6cfdcea91fa01583985e586db01ef07749c5d1629091117661e7f60db0a9d0e4bd451b8
SSDEEP

3072:bXlvFgvATyfHSt0Vki6jKV1c2jZZIUh7yZGRXBOUEs64BRg40nuFbl3TQ9:b4vj562V/UZ+BUeBRgul29

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT 5.0.5

Botnet

Venom Clients

C2

theyk6836.duckdns.org:9026

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1372-63-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat
behavioral1/memory/1372-62-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat
behavioral1/memory/1372-64-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat
behavioral1/memory/1372-65-0x00000000004109EE-mapping.dmp	asyncrat
behavioral1/memory/1372-69-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat
behavioral1/memory/1372-67-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat
behavioral1/memory/836-85-0x00000000004109EE-mapping.dmp	asyncrat

Executes dropped EXE 2 IoCs

Processes:

redfv.exeredfv.exe

pid process

1156 redfv.exe
1212 redfv.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 2 IoCs

Processes:

redfv.exeredfv.exe

description pid process target process

PID 2016 set thread context of 1372 2016 redfv.exe vbc.exe
PID 1156 set thread context of 836 1156 redfv.exe vbc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1568 schtasks.exe
568 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

vbc.exevbc.exe

description pid process

Token: SeDebugPrivilege 1372 vbc.exe
Token: SeDebugPrivilege 836 vbc.exe

pid	process
1156	redfv.exe
1212	redfv.exe

description	pid	process	target process
PID 2016 set thread context of 1372	2016	redfv.exe	vbc.exe
PID 1156 set thread context of 836	1156	redfv.exe	vbc.exe

pid	process
1568	schtasks.exe
568	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1372	vbc.exe
Token: SeDebugPrivilege	836	vbc.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

redfv.execmd.exetaskeng.exeredfv.execmd.exe

description	pid	process	target process
PID 2016 wrote to memory of 1756	2016	redfv.exe	cmd.exe
PID 2016 wrote to memory of 1756	2016	redfv.exe	cmd.exe
PID 2016 wrote to memory of 1756	2016	redfv.exe	cmd.exe
PID 2016 wrote to memory of 1756	2016	redfv.exe	cmd.exe
PID 1756 wrote to memory of 1568	1756	cmd.exe	schtasks.exe
PID 1756 wrote to memory of 1568	1756	cmd.exe	schtasks.exe
PID 1756 wrote to memory of 1568	1756	cmd.exe	schtasks.exe
PID 1756 wrote to memory of 1568	1756	cmd.exe	schtasks.exe
PID 2016 wrote to memory of 1748	2016	redfv.exe	cmd.exe
PID 2016 wrote to memory of 1748	2016	redfv.exe	cmd.exe
PID 2016 wrote to memory of 1748	2016	redfv.exe	cmd.exe
PID 2016 wrote to memory of 1748	2016	redfv.exe	cmd.exe
PID 2016 wrote to memory of 1372	2016	redfv.exe	vbc.exe
PID 2016 wrote to memory of 1372	2016	redfv.exe	vbc.exe
PID 2016 wrote to memory of 1372	2016	redfv.exe	vbc.exe
PID 2016 wrote to memory of 1372	2016	redfv.exe	vbc.exe
PID 2016 wrote to memory of 1372	2016	redfv.exe	vbc.exe
PID 2016 wrote to memory of 1372	2016	redfv.exe	vbc.exe
PID 2016 wrote to memory of 1372	2016	redfv.exe	vbc.exe
PID 2016 wrote to memory of 1372	2016	redfv.exe	vbc.exe
PID 2016 wrote to memory of 1372	2016	redfv.exe	vbc.exe
PID 676 wrote to memory of 1156	676	taskeng.exe	redfv.exe
PID 676 wrote to memory of 1156	676	taskeng.exe	redfv.exe
PID 676 wrote to memory of 1156	676	taskeng.exe	redfv.exe
PID 676 wrote to memory of 1156	676	taskeng.exe	redfv.exe
PID 1156 wrote to memory of 2040	1156	redfv.exe	cmd.exe
PID 1156 wrote to memory of 2040	1156	redfv.exe	cmd.exe
PID 1156 wrote to memory of 2040	1156	redfv.exe	cmd.exe
PID 1156 wrote to memory of 2040	1156	redfv.exe	cmd.exe
PID 1156 wrote to memory of 1760	1156	redfv.exe	cmd.exe
PID 1156 wrote to memory of 1760	1156	redfv.exe	cmd.exe
PID 1156 wrote to memory of 1760	1156	redfv.exe	cmd.exe
PID 1156 wrote to memory of 1760	1156	redfv.exe	cmd.exe
PID 2040 wrote to memory of 568	2040	cmd.exe	schtasks.exe
PID 2040 wrote to memory of 568	2040	cmd.exe	schtasks.exe
PID 2040 wrote to memory of 568	2040	cmd.exe	schtasks.exe
PID 2040 wrote to memory of 568	2040	cmd.exe	schtasks.exe
PID 1156 wrote to memory of 836	1156	redfv.exe	vbc.exe
PID 1156 wrote to memory of 836	1156	redfv.exe	vbc.exe
PID 1156 wrote to memory of 836	1156	redfv.exe	vbc.exe
PID 1156 wrote to memory of 836	1156	redfv.exe	vbc.exe
PID 1156 wrote to memory of 836	1156	redfv.exe	vbc.exe
PID 1156 wrote to memory of 836	1156	redfv.exe	vbc.exe
PID 1156 wrote to memory of 836	1156	redfv.exe	vbc.exe
PID 1156 wrote to memory of 836	1156	redfv.exe	vbc.exe
PID 1156 wrote to memory of 836	1156	redfv.exe	vbc.exe
PID 676 wrote to memory of 1212	676	taskeng.exe	redfv.exe
PID 676 wrote to memory of 1212	676	taskeng.exe	redfv.exe
PID 676 wrote to memory of 1212	676	taskeng.exe	redfv.exe
PID 676 wrote to memory of 1212	676	taskeng.exe	redfv.exe

C:\Users\Admin\AppData\Local\Temp\redfv.exe
"C:\Users\Admin\AppData\Local\Temp\redfv.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\redfv.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\redfv.exe'" /f
3⤵
- Creates scheduled task(s)
PID:1568

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\redfv.exe" "C:\Users\Admin\AppData\Roaming\redfv.exe"
2⤵
PID:1748

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Windows\system32\taskeng.exe
taskeng.exe {3727689B-3665-49A1-A7C4-6662F0C5A7C4} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:676

C:\Users\Admin\AppData\Roaming\redfv.exe
C:\Users\Admin\AppData\Roaming\redfv.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\redfv.exe'" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\redfv.exe'" /f
4⤵
- Creates scheduled task(s)
PID:568

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\redfv.exe" "C:\Users\Admin\AppData\Roaming\redfv.exe"
3⤵
PID:1760

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:836

C:\Users\Admin\AppData\Roaming\redfv.exe
C:\Users\Admin\AppData\Roaming\redfv.exe
2⤵
- Executes dropped EXE
PID:1212

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\redfv.exe
Filesize
300.0MB

MD5
f2fe09806411a018f01bb6a12a80b2b2

SHA1
c08c933ff0bd50a1bded400f086378ddaab5ba4d

SHA256
e2f693427eb98ff14d97a66007433ddebb3a8311309e2b1f1a95a07c3ec397b4

SHA512
e435ef3941858b3e3a4d24bfd9778b9c683185472cdd326209dfdbfdc6cfdcea91fa01583985e586db01ef07749c5d1629091117661e7f60db0a9d0e4bd451b8

Download Submit
C:\Users\Admin\AppData\Roaming\redfv.exe
Filesize
300.0MB

MD5
f2fe09806411a018f01bb6a12a80b2b2

SHA1
c08c933ff0bd50a1bded400f086378ddaab5ba4d

SHA256
e2f693427eb98ff14d97a66007433ddebb3a8311309e2b1f1a95a07c3ec397b4

SHA512
e435ef3941858b3e3a4d24bfd9778b9c683185472cdd326209dfdbfdc6cfdcea91fa01583985e586db01ef07749c5d1629091117661e7f60db0a9d0e4bd451b8

Download Submit
C:\Users\Admin\AppData\Roaming\redfv.exe
Filesize
300.0MB

MD5
f2fe09806411a018f01bb6a12a80b2b2

SHA1
c08c933ff0bd50a1bded400f086378ddaab5ba4d

SHA256
e2f693427eb98ff14d97a66007433ddebb3a8311309e2b1f1a95a07c3ec397b4

SHA512
e435ef3941858b3e3a4d24bfd9778b9c683185472cdd326209dfdbfdc6cfdcea91fa01583985e586db01ef07749c5d1629091117661e7f60db0a9d0e4bd451b8

Download Submit
memory/568-78-0x0000000000000000-mapping.dmp

Download
memory/836-85-0x00000000004109EE-mapping.dmp

Download
memory/1156-74-0x00000000002C0000-0x00000000002F0000-memory.dmp

Filesize
192KB

Download
memory/1156-72-0x0000000000000000-mapping.dmp

Download
memory/1212-93-0x0000000001370000-0x00000000013A0000-memory.dmp

Filesize
192KB

Download
memory/1212-91-0x0000000000000000-mapping.dmp

Download
memory/1372-67-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1372-63-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1372-69-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1372-59-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1372-64-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1372-60-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1372-62-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1372-65-0x00000000004109EE-mapping.dmp

Download
memory/1568-57-0x0000000000000000-mapping.dmp

Download
memory/1748-58-0x0000000000000000-mapping.dmp

Download
memory/1756-56-0x0000000000000000-mapping.dmp

Download
memory/1760-77-0x0000000000000000-mapping.dmp

Download
memory/2016-54-0x0000000001170000-0x00000000011A0000-memory.dmp

Filesize
192KB

Download
memory/2016-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/2040-76-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads