Analysis
-
max time kernel
33s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
28-09-2022 04:32
General
-
Target
VenomRAT_HVNC.exe
-
Size
16.5MB
-
MD5
31be8acd11aa5738dd970410adb597da
-
SHA1
cd4d52b884066e1a47fd27b616cfafeb66225cde
-
SHA256
e78a5ee885dc3b170a5e009aaf1a2db565ac1bf729a0c2195ebfe56420717abb
-
SHA512
ee621bf362cd717d9b026f14e5ff1da5f28fbdb5c58dacd3a8da120e5472baaaef22b052a08d51d49b6dae30cf15178b588acd5cb3596c2e0f2ef533e467ba94
-
SSDEEP
393216:Hl9Yl7Elel7ElAlQleTl/l/l/l/l/lzlml/lqlZlHl/l/l/l/l/l/lIlAl+lUl2+:JTXT
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
Async RAT payload 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VenomRAT_HVNC.exe"C:\Users\Admin\AppData\Local\Temp\VenomRAT_HVNC.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 2336 -ip 23361⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2336 -s 17601⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\a41ef880-d88e-4a33-9618-41469a92ce4d\AgileDotNetRT64.dllFilesize
75KB
MD542b2c266e49a3acd346b91e3b0e638c0
SHA12bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA256adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
SHA512770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
-
memory/1248-132-0x0000014275F70000-0x0000014277000000-memory.dmpFilesize
16.6MB
-
memory/1248-133-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmpFilesize
10.8MB
-
memory/1248-134-0x000001427A2C0000-0x000001427A4D0000-memory.dmpFilesize
2.1MB
-
memory/1248-136-0x00007FF8CCC10000-0x00007FF8CCD5E000-memory.dmpFilesize
1.3MB
-
memory/1248-137-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmpFilesize
10.8MB
-
memory/1248-138-0x000001427F8F0000-0x000001427FB42000-memory.dmpFilesize
2.3MB
-
memory/1248-139-0x000001427D9A0000-0x000001427D9AA000-memory.dmpFilesize
40KB
-
memory/1248-140-0x000001427FC60000-0x000001427FED8000-memory.dmpFilesize
2.5MB