Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-09-2022 14:41

General

  • Target

    URFT06GSBAWRP_001_PDF/URFT06GSBAWRP_001_PDF.exe

  • Size

    300MB

  • MD5

    464753cd8a6523de0fba921ce6846177

  • SHA1

    6b3b77af1129f9ad86acc31163d8450eacb4dbd3

  • SHA256

    3221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092

  • SHA512

    589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2

  • SSDEEP

    3072:1iJZ3k2p8jrvVIYkwur2JMBZ6kINhCRFuaABOUEs64BRg40nOFblHTgr4:1OyRr9u1KJkZ6dIYBUeBRgOlWU

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT 5.0.5

Botnet

Venom Clients

C2

resulttoday2.duckdns.org:6111

Attributes
delay
1
install
false
install_folder
%AppData%
aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Async RAT payload ⋅ 1 IoCs
  • Executes dropped EXE ⋅ 1 IoCs
  • Uses the VBS compiler for execution ⋅ 1 TTPs
  • Suspicious use of SetThreadContext ⋅ 2 IoCs
  • Creates scheduled task(s) ⋅ 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF\URFT06GSBAWRP_001_PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF\URFT06GSBAWRP_001_PDF.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f
      Suspicious use of WriteProcessMemory
      PID:1244
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f
        Creates scheduled task(s)
        PID:3428
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF\URFT06GSBAWRP_001_PDF.exe" "C:\Users\Admin\AppData\Roaming\opetr.exe"
      PID:3572
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      Suspicious use of AdjustPrivilegeToken
      PID:4392
  • C:\Users\Admin\AppData\Roaming\opetr.exe
    C:\Users\Admin\AppData\Roaming\opetr.exe
    Executes dropped EXE
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:3304
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f
      Suspicious use of WriteProcessMemory
      PID:2136
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f
        Creates scheduled task(s)
        PID:3460
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c copy "C:\Users\Admin\AppData\Roaming\opetr.exe" "C:\Users\Admin\AppData\Roaming\opetr.exe"
      PID:1892
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      Suspicious use of AdjustPrivilegeToken
      PID:4408

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • C:\Users\Admin\AppData\Roaming\opetr.exe
                        MD5

                        464753cd8a6523de0fba921ce6846177

                        SHA1

                        6b3b77af1129f9ad86acc31163d8450eacb4dbd3

                        SHA256

                        3221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092

                        SHA512

                        589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2

                      • C:\Users\Admin\AppData\Roaming\opetr.exe
                        MD5

                        464753cd8a6523de0fba921ce6846177

                        SHA1

                        6b3b77af1129f9ad86acc31163d8450eacb4dbd3

                        SHA256

                        3221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092

                        SHA512

                        589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2

                      • memory/1244-134-0x0000000000000000-mapping.dmp
                      • memory/1892-147-0x0000000000000000-mapping.dmp
                      • memory/2136-146-0x0000000000000000-mapping.dmp
                      • memory/2304-136-0x0000000005A80000-0x0000000006024000-memory.dmp
                      • memory/2304-132-0x0000000000810000-0x0000000000842000-memory.dmp
                      • memory/2304-133-0x0000000005460000-0x00000000054C6000-memory.dmp
                      • memory/3428-135-0x0000000000000000-mapping.dmp
                      • memory/3460-150-0x0000000000000000-mapping.dmp
                      • memory/3572-137-0x0000000000000000-mapping.dmp
                      • memory/4392-138-0x0000000000000000-mapping.dmp
                      • memory/4392-139-0x0000000000400000-0x0000000000416000-memory.dmp
                      • memory/4392-140-0x00000000061B0000-0x000000000624C000-memory.dmp
                      • memory/4392-141-0x00000000071B0000-0x0000000007226000-memory.dmp
                      • memory/4392-142-0x0000000007150000-0x000000000716E000-memory.dmp
                      • memory/4392-143-0x0000000007520000-0x00000000075B2000-memory.dmp
                      • memory/4408-148-0x0000000000000000-mapping.dmp