asyncrat | 5e1927efa5893ea03dedbcbfd93bd55e502e842ab8f0f868377838b9ae200ee5

Analysis

max time kernel
154s
max time network
157s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14/10/2022, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QWEDFGHNM01LKJNB70.exe
Size

300.0MB
MD5

dc03290442587a0f396214227b2a95c3
SHA1

6c25ed2e5f38277405b11c162c6e347dd13f80b1
SHA256

3a0c56f5de394f437e20cd22718e1feb0a3d66aeb13fb60f4b5a61e04bfea2f6
SHA512

e5a62ef9d41b66e5f7e5ffd6861bcdbb7d34ee81ec40aa6c6801441e1e0460f3e262ecd270d7641aa332fa468e385da36c9ffeb54eab2cc7372a1bb9be5259eb
SSDEEP

3072:NtX+qpAgYWQAZWy6tQ3bNwymWIi7sGe8IsPsBAAAAAAAAAAAAAAAAAASY:OqpTQAZz6+Nwe8Ge8XC

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT 5.0.5

Botnet

Venom Clients

g896696.duckdns.org:7343

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 9 IoCs

rat

resource	yara_rule
behavioral1/memory/700-63-0x0000000000080000-0x0000000000096000-memory.dmp	asyncrat
behavioral1/memory/700-62-0x0000000000080000-0x0000000000096000-memory.dmp	asyncrat
behavioral1/memory/700-65-0x00000000004109DE-mapping.dmp	asyncrat
behavioral1/memory/700-67-0x0000000000080000-0x0000000000096000-memory.dmp	asyncrat
behavioral1/memory/700-66-0x0000000000080000-0x0000000000096000-memory.dmp	asyncrat
behavioral1/memory/700-71-0x0000000000080000-0x0000000000096000-memory.dmp	asyncrat
behavioral1/memory/700-74-0x0000000000080000-0x0000000000096000-memory.dmp	asyncrat
behavioral1/memory/1316-90-0x00000000004109DE-mapping.dmp	asyncrat
behavioral1/memory/1640-114-0x00000000004109DE-mapping.dmp	asyncrat

Executes dropped EXE 2 IoCs

pid	Process
296	poijh.exe
1068	poijh.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1552 set thread context of 700	1552	QWEDFGHNM01LKJNB70.exe	31
PID 296 set thread context of 1316	296	poijh.exe	35
PID 1068 set thread context of 1640	1068	poijh.exe	46

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1076	schtasks.exe
912	schtasks.exe
960	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	700	vbc.exe
Token: SeDebugPrivilege	1316	vbc.exe
Token: SeDebugPrivilege	1640	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 904	1552	QWEDFGHNM01LKJNB70.exe	26
PID 1552 wrote to memory of 904	1552	QWEDFGHNM01LKJNB70.exe	26
PID 1552 wrote to memory of 904	1552	QWEDFGHNM01LKJNB70.exe	26
PID 1552 wrote to memory of 904	1552	QWEDFGHNM01LKJNB70.exe	26
PID 1552 wrote to memory of 280	1552	QWEDFGHNM01LKJNB70.exe	28
PID 1552 wrote to memory of 280	1552	QWEDFGHNM01LKJNB70.exe	28
PID 1552 wrote to memory of 280	1552	QWEDFGHNM01LKJNB70.exe	28
PID 1552 wrote to memory of 280	1552	QWEDFGHNM01LKJNB70.exe	28
PID 904 wrote to memory of 1076	904	cmd.exe	30
PID 904 wrote to memory of 1076	904	cmd.exe	30
PID 904 wrote to memory of 1076	904	cmd.exe	30
PID 904 wrote to memory of 1076	904	cmd.exe	30
PID 1552 wrote to memory of 700	1552	QWEDFGHNM01LKJNB70.exe	31
PID 1552 wrote to memory of 700	1552	QWEDFGHNM01LKJNB70.exe	31
PID 1552 wrote to memory of 700	1552	QWEDFGHNM01LKJNB70.exe	31
PID 1552 wrote to memory of 700	1552	QWEDFGHNM01LKJNB70.exe	31
PID 1552 wrote to memory of 700	1552	QWEDFGHNM01LKJNB70.exe	31
PID 1552 wrote to memory of 700	1552	QWEDFGHNM01LKJNB70.exe	31
PID 1552 wrote to memory of 700	1552	QWEDFGHNM01LKJNB70.exe	31
PID 1552 wrote to memory of 700	1552	QWEDFGHNM01LKJNB70.exe	31
PID 1552 wrote to memory of 700	1552	QWEDFGHNM01LKJNB70.exe	31
PID 1832 wrote to memory of 296	1832	taskeng.exe	33
PID 1832 wrote to memory of 296	1832	taskeng.exe	33
PID 1832 wrote to memory of 296	1832	taskeng.exe	33
PID 1832 wrote to memory of 296	1832	taskeng.exe	33
PID 296 wrote to memory of 1628	296	poijh.exe	34
PID 296 wrote to memory of 1628	296	poijh.exe	34
PID 296 wrote to memory of 1628	296	poijh.exe	34
PID 296 wrote to memory of 1628	296	poijh.exe	34
PID 296 wrote to memory of 1828	296	poijh.exe	38
PID 296 wrote to memory of 1828	296	poijh.exe	38
PID 296 wrote to memory of 1828	296	poijh.exe	38
PID 296 wrote to memory of 1828	296	poijh.exe	38
PID 296 wrote to memory of 1316	296	poijh.exe	35
PID 296 wrote to memory of 1316	296	poijh.exe	35
PID 296 wrote to memory of 1316	296	poijh.exe	35
PID 296 wrote to memory of 1316	296	poijh.exe	35
PID 296 wrote to memory of 1316	296	poijh.exe	35
PID 296 wrote to memory of 1316	296	poijh.exe	35
PID 296 wrote to memory of 1316	296	poijh.exe	35
PID 296 wrote to memory of 1316	296	poijh.exe	35
PID 296 wrote to memory of 1316	296	poijh.exe	35
PID 1628 wrote to memory of 912	1628	cmd.exe	39
PID 1628 wrote to memory of 912	1628	cmd.exe	39
PID 1628 wrote to memory of 912	1628	cmd.exe	39
PID 1628 wrote to memory of 912	1628	cmd.exe	39
PID 1832 wrote to memory of 1068	1832	taskeng.exe	40
PID 1832 wrote to memory of 1068	1832	taskeng.exe	40
PID 1832 wrote to memory of 1068	1832	taskeng.exe	40
PID 1832 wrote to memory of 1068	1832	taskeng.exe	40
PID 1068 wrote to memory of 1296	1068	poijh.exe	41
PID 1068 wrote to memory of 1296	1068	poijh.exe	41
PID 1068 wrote to memory of 1296	1068	poijh.exe	41
PID 1068 wrote to memory of 1296	1068	poijh.exe	41
PID 1068 wrote to memory of 1900	1068	poijh.exe	42
PID 1068 wrote to memory of 1900	1068	poijh.exe	42
PID 1068 wrote to memory of 1900	1068	poijh.exe	42
PID 1068 wrote to memory of 1900	1068	poijh.exe	42
PID 1296 wrote to memory of 960	1296	cmd.exe	45
PID 1296 wrote to memory of 960	1296	cmd.exe	45
PID 1296 wrote to memory of 960	1296	cmd.exe	45
PID 1296 wrote to memory of 960	1296	cmd.exe	45
PID 1068 wrote to memory of 1640	1068	poijh.exe	46
PID 1068 wrote to memory of 1640	1068	poijh.exe	46

C:\Users\Admin\AppData\Local\Temp\QWEDFGHNM01LKJNB70.exe
"C:\Users\Admin\AppData\Local\Temp\QWEDFGHNM01LKJNB70.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\poijh.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\poijh.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:1076
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\QWEDFGHNM01LKJNB70.exe" "C:\Users\Admin\AppData\Roaming\poijh.exe"
  2⤵
  PID:280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:700

C:\Windows\system32\taskeng.exe
taskeng.exe {3DB1D5FB-AC80-4C3B-84E2-0DC961E30955} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Roaming\poijh.exe
  C:\Users\Admin\AppData\Roaming\poijh.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:296
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\poijh.exe'" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\poijh.exe'" /f
      4⤵
      Creates scheduled task(s)
      PID:912
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1316
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c copy "C:\Users\Admin\AppData\Roaming\poijh.exe" "C:\Users\Admin\AppData\Roaming\poijh.exe"
    3⤵
    PID:1828
- C:\Users\Admin\AppData\Roaming\poijh.exe
  C:\Users\Admin\AppData\Roaming\poijh.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\poijh.exe'" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\poijh.exe'" /f
      4⤵
      Creates scheduled task(s)
      PID:960
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c copy "C:\Users\Admin\AppData\Roaming\poijh.exe" "C:\Users\Admin\AppData\Roaming\poijh.exe"
    3⤵
    PID:1900
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\poijh.exe

Filesize
300.0MB

MD5
dc03290442587a0f396214227b2a95c3

SHA1
6c25ed2e5f38277405b11c162c6e347dd13f80b1

SHA256
3a0c56f5de394f437e20cd22718e1feb0a3d66aeb13fb60f4b5a61e04bfea2f6

SHA512
e5a62ef9d41b66e5f7e5ffd6861bcdbb7d34ee81ec40aa6c6801441e1e0460f3e262ecd270d7641aa332fa468e385da36c9ffeb54eab2cc7372a1bb9be5259eb

Download Submit
C:\Users\Admin\AppData\Roaming\poijh.exe

Filesize
300.0MB

MD5
dc03290442587a0f396214227b2a95c3

SHA1
6c25ed2e5f38277405b11c162c6e347dd13f80b1

SHA256
3a0c56f5de394f437e20cd22718e1feb0a3d66aeb13fb60f4b5a61e04bfea2f6

SHA512
e5a62ef9d41b66e5f7e5ffd6861bcdbb7d34ee81ec40aa6c6801441e1e0460f3e262ecd270d7641aa332fa468e385da36c9ffeb54eab2cc7372a1bb9be5259eb

Download Submit
C:\Users\Admin\AppData\Roaming\poijh.exe

Filesize
300.0MB

MD5
dc03290442587a0f396214227b2a95c3

SHA1
6c25ed2e5f38277405b11c162c6e347dd13f80b1

SHA256
3a0c56f5de394f437e20cd22718e1feb0a3d66aeb13fb60f4b5a61e04bfea2f6

SHA512
e5a62ef9d41b66e5f7e5ffd6861bcdbb7d34ee81ec40aa6c6801441e1e0460f3e262ecd270d7641aa332fa468e385da36c9ffeb54eab2cc7372a1bb9be5259eb

Download Submit
memory/296-79-0x0000000000BC0000-0x0000000000BE8000-memory.dmp

Filesize
160KB

Download
memory/700-74-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/700-71-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/700-62-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/700-64-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/700-67-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/700-66-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/700-63-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/700-59-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/700-60-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/1068-103-0x0000000000CF0000-0x0000000000D18000-memory.dmp

Filesize
160KB

Download
memory/1552-55-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/1552-54-0x0000000000F70000-0x0000000000F98000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads