asyncrat | 7b8903ecd317229c5143148041cb99ac5ffa9423465d188174f0a08059be03e8

General

Target

QUOPDFH08HSCAV_001_PDF.exe
Size

2.1MB
MD5

269d77ceef4f796d137736c2dc1aaa1c
SHA1

f31bcd87587432293f3947301da1b719b2a85993
SHA256

7b8903ecd317229c5143148041cb99ac5ffa9423465d188174f0a08059be03e8
SHA512

1dc7b9429fb7ce5c80991728ddd073f3b6c90bb5c6ef550766c727b896d1f785d258603897f3cb295e8a627a51c8d6305abcc5baa88e31e46549c0b9c10520c0
SSDEEP

3072:UV3mYPmt+qHIhx9jkS/F0M7zO6Ycw0TmBOUEs64BRg40nuFblnTAyO:gVPRzOvcwLBUeBRgulW/

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT 5.0.5

Botnet

Venom Clients

C2

saralynnp8.duckdns.org:8302

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/336-63-0x0000000000080000-0x0000000000096000-memory.dmp	asyncrat
behavioral1/memory/336-62-0x0000000000080000-0x0000000000096000-memory.dmp	asyncrat
behavioral1/memory/336-65-0x00000000004109EE-mapping.dmp	asyncrat
behavioral1/memory/336-74-0x0000000000080000-0x0000000000096000-memory.dmp	asyncrat
behavioral1/memory/336-71-0x0000000000080000-0x0000000000096000-memory.dmp	asyncrat
behavioral1/memory/336-67-0x0000000000080000-0x0000000000096000-memory.dmp	asyncrat
behavioral1/memory/336-66-0x0000000000080000-0x0000000000096000-memory.dmp	asyncrat
behavioral1/memory/652-90-0x00000000004109EE-mapping.dmp	asyncrat

Executes dropped EXE 2 IoCs

Processes:

vnfne.exevnfne.exe

pid process

1772 vnfne.exe
528 vnfne.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
1772	vnfne.exe
528	vnfne.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

QUOPDFH08HSCAV_001_PDF.exevnfne.exe

description	pid	process	target process
PID 1368 set thread context of 336	1368	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 1772 set thread context of 652	1772	vnfne.exe	vbc.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1504 schtasks.exe
1320 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

vbc.exevbc.exe

description pid process

Token: SeDebugPrivilege 336 vbc.exe
Token: SeDebugPrivilege 652 vbc.exe

pid	process
1504	schtasks.exe
1320	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	336	vbc.exe
Token: SeDebugPrivilege	652	vbc.exe

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

QUOPDFH08HSCAV_001_PDF.execmd.exetaskeng.exevnfne.execmd.exe

description	pid	process	target process
PID 1368 wrote to memory of 1984	1368	QUOPDFH08HSCAV_001_PDF.exe	cmd.exe
PID 1368 wrote to memory of 1984	1368	QUOPDFH08HSCAV_001_PDF.exe	cmd.exe
PID 1368 wrote to memory of 1984	1368	QUOPDFH08HSCAV_001_PDF.exe	cmd.exe
PID 1368 wrote to memory of 1984	1368	QUOPDFH08HSCAV_001_PDF.exe	cmd.exe
PID 1984 wrote to memory of 1504	1984	cmd.exe	schtasks.exe
PID 1984 wrote to memory of 1504	1984	cmd.exe	schtasks.exe
PID 1984 wrote to memory of 1504	1984	cmd.exe	schtasks.exe
PID 1984 wrote to memory of 1504	1984	cmd.exe	schtasks.exe
PID 1368 wrote to memory of 896	1368	QUOPDFH08HSCAV_001_PDF.exe	cmd.exe
PID 1368 wrote to memory of 896	1368	QUOPDFH08HSCAV_001_PDF.exe	cmd.exe
PID 1368 wrote to memory of 896	1368	QUOPDFH08HSCAV_001_PDF.exe	cmd.exe
PID 1368 wrote to memory of 896	1368	QUOPDFH08HSCAV_001_PDF.exe	cmd.exe
PID 1368 wrote to memory of 336	1368	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 1368 wrote to memory of 336	1368	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 1368 wrote to memory of 336	1368	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 1368 wrote to memory of 336	1368	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 1368 wrote to memory of 336	1368	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 1368 wrote to memory of 336	1368	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 1368 wrote to memory of 336	1368	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 1368 wrote to memory of 336	1368	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 1368 wrote to memory of 336	1368	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 1904 wrote to memory of 1772	1904	taskeng.exe	vnfne.exe
PID 1904 wrote to memory of 1772	1904	taskeng.exe	vnfne.exe
PID 1904 wrote to memory of 1772	1904	taskeng.exe	vnfne.exe
PID 1904 wrote to memory of 1772	1904	taskeng.exe	vnfne.exe
PID 1904 wrote to memory of 1772	1904	taskeng.exe	vnfne.exe
PID 1904 wrote to memory of 1772	1904	taskeng.exe	vnfne.exe
PID 1904 wrote to memory of 1772	1904	taskeng.exe	vnfne.exe
PID 1772 wrote to memory of 952	1772	vnfne.exe	cmd.exe
PID 1772 wrote to memory of 952	1772	vnfne.exe	cmd.exe
PID 1772 wrote to memory of 952	1772	vnfne.exe	cmd.exe
PID 1772 wrote to memory of 952	1772	vnfne.exe	cmd.exe
PID 1772 wrote to memory of 1684	1772	vnfne.exe	cmd.exe
PID 1772 wrote to memory of 1684	1772	vnfne.exe	cmd.exe
PID 1772 wrote to memory of 1684	1772	vnfne.exe	cmd.exe
PID 1772 wrote to memory of 1684	1772	vnfne.exe	cmd.exe
PID 952 wrote to memory of 1320	952	cmd.exe	schtasks.exe
PID 952 wrote to memory of 1320	952	cmd.exe	schtasks.exe
PID 952 wrote to memory of 1320	952	cmd.exe	schtasks.exe
PID 952 wrote to memory of 1320	952	cmd.exe	schtasks.exe
PID 1772 wrote to memory of 652	1772	vnfne.exe	vbc.exe
PID 1772 wrote to memory of 652	1772	vnfne.exe	vbc.exe
PID 1772 wrote to memory of 652	1772	vnfne.exe	vbc.exe
PID 1772 wrote to memory of 652	1772	vnfne.exe	vbc.exe
PID 1772 wrote to memory of 652	1772	vnfne.exe	vbc.exe
PID 1772 wrote to memory of 652	1772	vnfne.exe	vbc.exe
PID 1772 wrote to memory of 652	1772	vnfne.exe	vbc.exe
PID 1772 wrote to memory of 652	1772	vnfne.exe	vbc.exe
PID 1772 wrote to memory of 652	1772	vnfne.exe	vbc.exe
PID 1904 wrote to memory of 528	1904	taskeng.exe	vnfne.exe
PID 1904 wrote to memory of 528	1904	taskeng.exe	vnfne.exe
PID 1904 wrote to memory of 528	1904	taskeng.exe	vnfne.exe
PID 1904 wrote to memory of 528	1904	taskeng.exe	vnfne.exe
PID 1904 wrote to memory of 528	1904	taskeng.exe	vnfne.exe
PID 1904 wrote to memory of 528	1904	taskeng.exe	vnfne.exe
PID 1904 wrote to memory of 528	1904	taskeng.exe	vnfne.exe

C:\Users\Admin\AppData\Local\Temp\QUOPDFH08HSCAV_001_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\QUOPDFH08HSCAV_001_PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\vnfne.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\vnfne.exe'" /f
3⤵
- Creates scheduled task(s)
PID:1504

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\QUOPDFH08HSCAV_001_PDF.exe" "C:\Users\Admin\AppData\Roaming\vnfne.exe"
2⤵
PID:896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:336

C:\Windows\system32\taskeng.exe
taskeng.exe {31F8F92E-4BA2-433D-81A9-D0C43B19B83D} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Users\Admin\AppData\Roaming\vnfne.exe
C:\Users\Admin\AppData\Roaming\vnfne.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\vnfne.exe'" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\vnfne.exe'" /f
4⤵
- Creates scheduled task(s)
PID:1320

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\vnfne.exe" "C:\Users\Admin\AppData\Roaming\vnfne.exe"
3⤵
PID:1684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:652

C:\Users\Admin\AppData\Roaming\vnfne.exe
C:\Users\Admin\AppData\Roaming\vnfne.exe
2⤵
- Executes dropped EXE
PID:528

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\vnfne.exe
Filesize
2.1MB

MD5
269d77ceef4f796d137736c2dc1aaa1c

SHA1
f31bcd87587432293f3947301da1b719b2a85993

SHA256
7b8903ecd317229c5143148041cb99ac5ffa9423465d188174f0a08059be03e8

SHA512
1dc7b9429fb7ce5c80991728ddd073f3b6c90bb5c6ef550766c727b896d1f785d258603897f3cb295e8a627a51c8d6305abcc5baa88e31e46549c0b9c10520c0

Download Submit
C:\Users\Admin\AppData\Roaming\vnfne.exe
Filesize
2.1MB

MD5
269d77ceef4f796d137736c2dc1aaa1c

SHA1
f31bcd87587432293f3947301da1b719b2a85993

SHA256
7b8903ecd317229c5143148041cb99ac5ffa9423465d188174f0a08059be03e8

SHA512
1dc7b9429fb7ce5c80991728ddd073f3b6c90bb5c6ef550766c727b896d1f785d258603897f3cb295e8a627a51c8d6305abcc5baa88e31e46549c0b9c10520c0

Download Submit
C:\Users\Admin\AppData\Roaming\vnfne.exe
Filesize
2.1MB

MD5
269d77ceef4f796d137736c2dc1aaa1c

SHA1
f31bcd87587432293f3947301da1b719b2a85993

SHA256
7b8903ecd317229c5143148041cb99ac5ffa9423465d188174f0a08059be03e8

SHA512
1dc7b9429fb7ce5c80991728ddd073f3b6c90bb5c6ef550766c727b896d1f785d258603897f3cb295e8a627a51c8d6305abcc5baa88e31e46549c0b9c10520c0

Download Submit
memory/336-71-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/336-66-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/336-59-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/336-60-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/336-63-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/336-62-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/336-64-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/336-65-0x00000000004109EE-mapping.dmp

Download
memory/336-74-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/336-67-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/528-101-0x0000000000000000-mapping.dmp

Download
memory/652-90-0x00000000004109EE-mapping.dmp

Download
memory/896-58-0x0000000000000000-mapping.dmp

Download
memory/952-81-0x0000000000000000-mapping.dmp

Download
memory/1320-83-0x0000000000000000-mapping.dmp

Download
memory/1368-54-0x00000000012B0000-0x00000000012E0000-memory.dmp

Filesize
192KB

Download
memory/1368-55-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1504-57-0x0000000000000000-mapping.dmp

Download
memory/1684-82-0x0000000000000000-mapping.dmp

Download
memory/1772-77-0x0000000000000000-mapping.dmp

Download
memory/1772-79-0x0000000001190000-0x00000000011C0000-memory.dmp

Filesize
192KB

Download
memory/1984-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads