asyncrat | 7b8903ecd317229c5143148041cb99ac5ffa9423465d188174f0a08059be03e8

General

Target

QUOPDFH08HSCAV_001_PDF.exe
Size

2.1MB
MD5

269d77ceef4f796d137736c2dc1aaa1c
SHA1

f31bcd87587432293f3947301da1b719b2a85993
SHA256

7b8903ecd317229c5143148041cb99ac5ffa9423465d188174f0a08059be03e8
SHA512

1dc7b9429fb7ce5c80991728ddd073f3b6c90bb5c6ef550766c727b896d1f785d258603897f3cb295e8a627a51c8d6305abcc5baa88e31e46549c0b9c10520c0
SSDEEP

3072:UV3mYPmt+qHIhx9jkS/F0M7zO6Ycw0TmBOUEs64BRg40nuFblnTAyO:gVPRzOvcwLBUeBRgulW/

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT 5.0.5

Botnet

Venom Clients

C2

saralynnp8.duckdns.org:8302

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4760-138-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat

Executes dropped EXE 2 IoCs

Processes:

vnfne.exevnfne.exe

pid process

1916 vnfne.exe
3056 vnfne.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
1916	vnfne.exe
3056	vnfne.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

QUOPDFH08HSCAV_001_PDF.exevnfne.exe

description	pid	process	target process
PID 4580 set thread context of 4760	4580	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 1916 set thread context of 4208	1916	vnfne.exe	vbc.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

5100 schtasks.exe
4680 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

vbc.exevbc.exe

description pid process

Token: SeDebugPrivilege 4760 vbc.exe
Token: SeDebugPrivilege 4208 vbc.exe

pid	process
5100	schtasks.exe
4680	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	4760	vbc.exe
Token: SeDebugPrivilege	4208	vbc.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

QUOPDFH08HSCAV_001_PDF.execmd.exevnfne.execmd.exe

description	pid	process	target process
PID 4580 wrote to memory of 2932	4580	QUOPDFH08HSCAV_001_PDF.exe	cmd.exe
PID 4580 wrote to memory of 2932	4580	QUOPDFH08HSCAV_001_PDF.exe	cmd.exe
PID 4580 wrote to memory of 2932	4580	QUOPDFH08HSCAV_001_PDF.exe	cmd.exe
PID 2932 wrote to memory of 5100	2932	cmd.exe	schtasks.exe
PID 2932 wrote to memory of 5100	2932	cmd.exe	schtasks.exe
PID 2932 wrote to memory of 5100	2932	cmd.exe	schtasks.exe
PID 4580 wrote to memory of 100	4580	QUOPDFH08HSCAV_001_PDF.exe	cmd.exe
PID 4580 wrote to memory of 100	4580	QUOPDFH08HSCAV_001_PDF.exe	cmd.exe
PID 4580 wrote to memory of 100	4580	QUOPDFH08HSCAV_001_PDF.exe	cmd.exe
PID 4580 wrote to memory of 4760	4580	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 4580 wrote to memory of 4760	4580	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 4580 wrote to memory of 4760	4580	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 4580 wrote to memory of 4760	4580	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 4580 wrote to memory of 4760	4580	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 4580 wrote to memory of 4760	4580	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 4580 wrote to memory of 4760	4580	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 4580 wrote to memory of 4760	4580	QUOPDFH08HSCAV_001_PDF.exe	vbc.exe
PID 1916 wrote to memory of 4324	1916	vnfne.exe	cmd.exe
PID 1916 wrote to memory of 4324	1916	vnfne.exe	cmd.exe
PID 1916 wrote to memory of 4324	1916	vnfne.exe	cmd.exe
PID 4324 wrote to memory of 4680	4324	cmd.exe	schtasks.exe
PID 4324 wrote to memory of 4680	4324	cmd.exe	schtasks.exe
PID 4324 wrote to memory of 4680	4324	cmd.exe	schtasks.exe
PID 1916 wrote to memory of 4768	1916	vnfne.exe	cmd.exe
PID 1916 wrote to memory of 4768	1916	vnfne.exe	cmd.exe
PID 1916 wrote to memory of 4768	1916	vnfne.exe	cmd.exe
PID 1916 wrote to memory of 4208	1916	vnfne.exe	vbc.exe
PID 1916 wrote to memory of 4208	1916	vnfne.exe	vbc.exe
PID 1916 wrote to memory of 4208	1916	vnfne.exe	vbc.exe
PID 1916 wrote to memory of 4208	1916	vnfne.exe	vbc.exe
PID 1916 wrote to memory of 4208	1916	vnfne.exe	vbc.exe
PID 1916 wrote to memory of 4208	1916	vnfne.exe	vbc.exe
PID 1916 wrote to memory of 4208	1916	vnfne.exe	vbc.exe
PID 1916 wrote to memory of 4208	1916	vnfne.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\QUOPDFH08HSCAV_001_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\QUOPDFH08HSCAV_001_PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4580

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\vnfne.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\vnfne.exe'" /f
3⤵
- Creates scheduled task(s)
PID:5100

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\QUOPDFH08HSCAV_001_PDF.exe" "C:\Users\Admin\AppData\Roaming\vnfne.exe"
2⤵
PID:100

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Users\Admin\AppData\Roaming\vnfne.exe
C:\Users\Admin\AppData\Roaming\vnfne.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\vnfne.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:4324

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\vnfne.exe'" /f
3⤵
- Creates scheduled task(s)
PID:4680

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\vnfne.exe" "C:\Users\Admin\AppData\Roaming\vnfne.exe"
2⤵
PID:4768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Users\Admin\AppData\Roaming\vnfne.exe
C:\Users\Admin\AppData\Roaming\vnfne.exe
1⤵
- Executes dropped EXE
PID:3056

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vnfne.exe.log
Filesize
520B

MD5
41c37de2b4598f7759f865817dba5f80

SHA1
884ccf344bc2dd409425dc5ace0fd909a5f8cce4

SHA256
427235491a8da3fc8770ed60d30af731835c94585cd08d4d81fca9f703b283bc

SHA512
a8f3c74916623de100e4cf22e05df9cdf541b1e32443aab0434f35fb9c4a7fa950b997ce589b532e65731ae471a1f152cd5c00ea1df4bd7a6b57eb27c93c54bd

Download Submit
C:\Users\Admin\AppData\Roaming\vnfne.exe
Filesize
2.1MB

MD5
269d77ceef4f796d137736c2dc1aaa1c

SHA1
f31bcd87587432293f3947301da1b719b2a85993

SHA256
7b8903ecd317229c5143148041cb99ac5ffa9423465d188174f0a08059be03e8

SHA512
1dc7b9429fb7ce5c80991728ddd073f3b6c90bb5c6ef550766c727b896d1f785d258603897f3cb295e8a627a51c8d6305abcc5baa88e31e46549c0b9c10520c0

Download Submit
C:\Users\Admin\AppData\Roaming\vnfne.exe
Filesize
2.1MB

MD5
269d77ceef4f796d137736c2dc1aaa1c

SHA1
f31bcd87587432293f3947301da1b719b2a85993

SHA256
7b8903ecd317229c5143148041cb99ac5ffa9423465d188174f0a08059be03e8

SHA512
1dc7b9429fb7ce5c80991728ddd073f3b6c90bb5c6ef550766c727b896d1f785d258603897f3cb295e8a627a51c8d6305abcc5baa88e31e46549c0b9c10520c0

Download Submit
C:\Users\Admin\AppData\Roaming\vnfne.exe
Filesize
2.1MB

MD5
269d77ceef4f796d137736c2dc1aaa1c

SHA1
f31bcd87587432293f3947301da1b719b2a85993

SHA256
7b8903ecd317229c5143148041cb99ac5ffa9423465d188174f0a08059be03e8

SHA512
1dc7b9429fb7ce5c80991728ddd073f3b6c90bb5c6ef550766c727b896d1f785d258603897f3cb295e8a627a51c8d6305abcc5baa88e31e46549c0b9c10520c0

Download Submit
memory/100-136-0x0000000000000000-mapping.dmp

Download
memory/2932-133-0x0000000000000000-mapping.dmp

Download
memory/4208-146-0x0000000000000000-mapping.dmp

Download
memory/4324-143-0x0000000000000000-mapping.dmp

Download
memory/4580-135-0x0000000005E40000-0x00000000063E4000-memory.dmp

Filesize
5.6MB

Download
memory/4580-132-0x0000000000C90000-0x0000000000CC0000-memory.dmp

Filesize
192KB

Download
memory/4680-144-0x0000000000000000-mapping.dmp

Download
memory/4760-140-0x0000000006150000-0x00000000061B6000-memory.dmp

Filesize
408KB

Download
memory/4760-139-0x0000000006040000-0x00000000060DC000-memory.dmp

Filesize
624KB

Download
memory/4760-138-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4760-137-0x0000000000000000-mapping.dmp

Download
memory/4768-145-0x0000000000000000-mapping.dmp

Download
memory/5100-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads