asyncrat | e2f693427eb98ff14d97a66007433ddebb3a8311309e2b1f1a95a07c3ec397b4

General

Target

redfv.exe
Size

300.0MB
MD5

f2fe09806411a018f01bb6a12a80b2b2
SHA1

c08c933ff0bd50a1bded400f086378ddaab5ba4d
SHA256

e2f693427eb98ff14d97a66007433ddebb3a8311309e2b1f1a95a07c3ec397b4
SHA512

e435ef3941858b3e3a4d24bfd9778b9c683185472cdd326209dfdbfdc6cfdcea91fa01583985e586db01ef07749c5d1629091117661e7f60db0a9d0e4bd451b8
SSDEEP

3072:bXlvFgvATyfHSt0Vki6jKV1c2jZZIUh7yZGRXBOUEs64BRg40nuFbl3TQ9:b4vj562V/UZ+BUeBRgul29

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT 5.0.5

Botnet

Venom Clients

C2

theyk6836.duckdns.org:9026

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4408-139-0x0000000000830000-0x0000000000846000-memory.dmp	asyncrat

Executes dropped EXE 2 IoCs

Processes:

redfv.exeredfv.exe

pid process

2868 redfv.exe
4516 redfv.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 2 IoCs

Processes:

redfv.exeredfv.exe

description pid process target process

PID 4776 set thread context of 4408 4776 redfv.exe vbc.exe
PID 2868 set thread context of 1112 2868 redfv.exe vbc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

828 schtasks.exe
640 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

vbc.exevbc.exe

description pid process

Token: SeDebugPrivilege 4408 vbc.exe
Token: SeDebugPrivilege 1112 vbc.exe

pid	process
2868	redfv.exe
4516	redfv.exe

description	pid	process	target process
PID 4776 set thread context of 4408	4776	redfv.exe	vbc.exe
PID 2868 set thread context of 1112	2868	redfv.exe	vbc.exe

pid	process
828	schtasks.exe
640	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	4408	vbc.exe
Token: SeDebugPrivilege	1112	vbc.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

redfv.execmd.exeredfv.execmd.exe

description	pid	process	target process
PID 4776 wrote to memory of 4528	4776	redfv.exe	cmd.exe
PID 4776 wrote to memory of 4528	4776	redfv.exe	cmd.exe
PID 4776 wrote to memory of 4528	4776	redfv.exe	cmd.exe
PID 4528 wrote to memory of 828	4528	cmd.exe	schtasks.exe
PID 4528 wrote to memory of 828	4528	cmd.exe	schtasks.exe
PID 4528 wrote to memory of 828	4528	cmd.exe	schtasks.exe
PID 4776 wrote to memory of 3912	4776	redfv.exe	cmd.exe
PID 4776 wrote to memory of 3912	4776	redfv.exe	cmd.exe
PID 4776 wrote to memory of 3912	4776	redfv.exe	cmd.exe
PID 4776 wrote to memory of 4408	4776	redfv.exe	vbc.exe
PID 4776 wrote to memory of 4408	4776	redfv.exe	vbc.exe
PID 4776 wrote to memory of 4408	4776	redfv.exe	vbc.exe
PID 4776 wrote to memory of 4408	4776	redfv.exe	vbc.exe
PID 4776 wrote to memory of 4408	4776	redfv.exe	vbc.exe
PID 4776 wrote to memory of 4408	4776	redfv.exe	vbc.exe
PID 4776 wrote to memory of 4408	4776	redfv.exe	vbc.exe
PID 4776 wrote to memory of 4408	4776	redfv.exe	vbc.exe
PID 2868 wrote to memory of 548	2868	redfv.exe	cmd.exe
PID 2868 wrote to memory of 548	2868	redfv.exe	cmd.exe
PID 2868 wrote to memory of 548	2868	redfv.exe	cmd.exe
PID 2868 wrote to memory of 4248	2868	redfv.exe	cmd.exe
PID 2868 wrote to memory of 4248	2868	redfv.exe	cmd.exe
PID 2868 wrote to memory of 4248	2868	redfv.exe	cmd.exe
PID 548 wrote to memory of 640	548	cmd.exe	schtasks.exe
PID 548 wrote to memory of 640	548	cmd.exe	schtasks.exe
PID 548 wrote to memory of 640	548	cmd.exe	schtasks.exe
PID 2868 wrote to memory of 1112	2868	redfv.exe	vbc.exe
PID 2868 wrote to memory of 1112	2868	redfv.exe	vbc.exe
PID 2868 wrote to memory of 1112	2868	redfv.exe	vbc.exe
PID 2868 wrote to memory of 1112	2868	redfv.exe	vbc.exe
PID 2868 wrote to memory of 1112	2868	redfv.exe	vbc.exe
PID 2868 wrote to memory of 1112	2868	redfv.exe	vbc.exe
PID 2868 wrote to memory of 1112	2868	redfv.exe	vbc.exe
PID 2868 wrote to memory of 1112	2868	redfv.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\redfv.exe
"C:\Users\Admin\AppData\Local\Temp\redfv.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4776

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\redfv.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:4528

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\redfv.exe'" /f
3⤵
- Creates scheduled task(s)
PID:828

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\redfv.exe" "C:\Users\Admin\AppData\Roaming\redfv.exe"
2⤵
PID:3912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Users\Admin\AppData\Roaming\redfv.exe
C:\Users\Admin\AppData\Roaming\redfv.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2868

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\redfv.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:548

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\redfv.exe'" /f
3⤵
- Creates scheduled task(s)
PID:640

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\redfv.exe" "C:\Users\Admin\AppData\Roaming\redfv.exe"
2⤵
PID:4248

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2588

C:\Users\Admin\AppData\Roaming\redfv.exe
C:\Users\Admin\AppData\Roaming\redfv.exe
1⤵
- Executes dropped EXE
PID:4516

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\redfv.exe.log
Filesize
520B

MD5
41c37de2b4598f7759f865817dba5f80

SHA1
884ccf344bc2dd409425dc5ace0fd909a5f8cce4

SHA256
427235491a8da3fc8770ed60d30af731835c94585cd08d4d81fca9f703b283bc

SHA512
a8f3c74916623de100e4cf22e05df9cdf541b1e32443aab0434f35fb9c4a7fa950b997ce589b532e65731ae471a1f152cd5c00ea1df4bd7a6b57eb27c93c54bd

Download Submit
C:\Users\Admin\AppData\Roaming\redfv.exe
Filesize
300.0MB

MD5
f2fe09806411a018f01bb6a12a80b2b2

SHA1
c08c933ff0bd50a1bded400f086378ddaab5ba4d

SHA256
e2f693427eb98ff14d97a66007433ddebb3a8311309e2b1f1a95a07c3ec397b4

SHA512
e435ef3941858b3e3a4d24bfd9778b9c683185472cdd326209dfdbfdc6cfdcea91fa01583985e586db01ef07749c5d1629091117661e7f60db0a9d0e4bd451b8

Download Submit
C:\Users\Admin\AppData\Roaming\redfv.exe
Filesize
300.0MB

MD5
f2fe09806411a018f01bb6a12a80b2b2

SHA1
c08c933ff0bd50a1bded400f086378ddaab5ba4d

SHA256
e2f693427eb98ff14d97a66007433ddebb3a8311309e2b1f1a95a07c3ec397b4

SHA512
e435ef3941858b3e3a4d24bfd9778b9c683185472cdd326209dfdbfdc6cfdcea91fa01583985e586db01ef07749c5d1629091117661e7f60db0a9d0e4bd451b8

Download Submit
C:\Users\Admin\AppData\Roaming\redfv.exe
Filesize
300.0MB

MD5
f2fe09806411a018f01bb6a12a80b2b2

SHA1
c08c933ff0bd50a1bded400f086378ddaab5ba4d

SHA256
e2f693427eb98ff14d97a66007433ddebb3a8311309e2b1f1a95a07c3ec397b4

SHA512
e435ef3941858b3e3a4d24bfd9778b9c683185472cdd326209dfdbfdc6cfdcea91fa01583985e586db01ef07749c5d1629091117661e7f60db0a9d0e4bd451b8

Download Submit
memory/548-143-0x0000000000000000-mapping.dmp

Download
memory/640-145-0x0000000000000000-mapping.dmp

Download
memory/828-134-0x0000000000000000-mapping.dmp

Download
memory/1112-146-0x0000000000000000-mapping.dmp

Download
memory/3912-136-0x0000000000000000-mapping.dmp

Download
memory/4248-144-0x0000000000000000-mapping.dmp

Download
memory/4408-139-0x0000000000830000-0x0000000000846000-memory.dmp

Filesize
88KB

Download
memory/4408-138-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4408-137-0x0000000000000000-mapping.dmp

Download
memory/4528-133-0x0000000000000000-mapping.dmp

Download
memory/4776-132-0x00000000001D0000-0x0000000000200000-memory.dmp

Filesize
192KB

Download
memory/4776-135-0x00000000053B0000-0x0000000005954000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads