asyncrat | 5448955815779876e98583d1accbd0cb8a6f525906c05d7bd828114cdf870193

General

Target

INV#001.exe
Size

300.0MB
MD5

79a721193aea183da48ebce3f397bcef
SHA1

3315518cf5be28cc5d6399f984308d9b276089cc
SHA256

5448955815779876e98583d1accbd0cb8a6f525906c05d7bd828114cdf870193
SHA512

21f688290c108da832a1480175958f55f22fa03efa212423fd33f0e389e82071ab6a3d046528c210babc83b400cf17fd90d9244abafbc496bc321d66d0b9804c
SSDEEP

6291456:SN889w7Nc2HK90Lxg4xMszaG3E0sR2eUAdBGU+yy/JsQA/qC:SN889Bg00Lu4xMgaGUxRZpdBGayR/oq

Score

10^/10

asyncrat venom clients persistence rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT 5.0.5

Botnet

Venom Clients

C2

yhsfgs.duckdns.org:8890

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2204-143-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

INV#001.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation INV#001.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	INV#001.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

INV#001.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hifikjoa = "\"C:\\Users\\Admin\\AppData\\Roaming\\Xyzffyjzjsk\\Hifikjoa.exe\""	INV#001.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

INV#001.exe

description pid process target process

PID 4804 set thread context of 2204 4804 INV#001.exe INV#001.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3984 1596 WerFault.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1464 powershell.exe
1464 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

INV#001.exepowershell.exeINV#001.exe

description pid process

Token: SeDebugPrivilege 4804 INV#001.exe
Token: SeDebugPrivilege 1464 powershell.exe
Token: SeDebugPrivilege 2204 INV#001.exe

description	pid	process	target process
PID 4804 set thread context of 2204	4804	INV#001.exe	INV#001.exe

pid	pid_target	process	target process
3984	1596	WerFault.exe

pid	process
1464	powershell.exe
1464	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4804	INV#001.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	2204	INV#001.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

INV#001.exe

description	pid	process	target process
PID 4804 wrote to memory of 1464	4804	INV#001.exe	powershell.exe
PID 4804 wrote to memory of 1464	4804	INV#001.exe	powershell.exe
PID 4804 wrote to memory of 1464	4804	INV#001.exe	powershell.exe
PID 4804 wrote to memory of 2204	4804	INV#001.exe	INV#001.exe
PID 4804 wrote to memory of 2204	4804	INV#001.exe	INV#001.exe
PID 4804 wrote to memory of 2204	4804	INV#001.exe	INV#001.exe
PID 4804 wrote to memory of 2204	4804	INV#001.exe	INV#001.exe
PID 4804 wrote to memory of 2204	4804	INV#001.exe	INV#001.exe
PID 4804 wrote to memory of 2204	4804	INV#001.exe	INV#001.exe
PID 4804 wrote to memory of 2204	4804	INV#001.exe	INV#001.exe
PID 4804 wrote to memory of 2204	4804	INV#001.exe	INV#001.exe

C:\Users\Admin\AppData\Local\Temp\INV#001.exe
"C:\Users\Admin\AppData\Local\Temp\INV#001.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1464

C:\Users\Admin\AppData\Local\Temp\INV#001.exe
C:\Users\Admin\AppData\Local\Temp\INV#001.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 1596 -ip 1596
1⤵
PID:204

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1596 -s 2432
1⤵
- Program crash
PID:3984

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INV#001.exe.log
Filesize
1KB

MD5
e87e48b105757e1c7563d1c719059733

SHA1
28a3f2b2e0672da2b531f4757d2b20b53032dafc

SHA256
0aaf22dc84cc3fcfe53de7ccfed8e662247dfb7f1a9967032c88790d0c663461

SHA512
bf19c5743143aee914a453c41189c722c9b90a5b8bf299cecf3e1f97656d32cd209ecb74da8aebc89bb41c27d189f73aaaabbc64fe383410c95dc76ad4218968

Download Submit
memory/1464-138-0x0000000005880000-0x00000000058E6000-memory.dmp

Filesize
408KB

Download
memory/1464-140-0x0000000007540000-0x0000000007BBA000-memory.dmp

Filesize
6.5MB

Download
memory/1464-135-0x0000000002920000-0x0000000002956000-memory.dmp

Filesize
216KB

Download
memory/1464-136-0x0000000004FB0000-0x00000000055D8000-memory.dmp

Filesize
6.2MB

Download
memory/1464-137-0x00000000055E0000-0x0000000005646000-memory.dmp

Filesize
408KB

Download
memory/1464-141-0x00000000063D0000-0x00000000063EA000-memory.dmp

Filesize
104KB

Download
memory/1464-139-0x0000000005EC0000-0x0000000005EDE000-memory.dmp

Filesize
120KB

Download
memory/1464-134-0x0000000000000000-mapping.dmp

Download
memory/2204-142-0x0000000000000000-mapping.dmp

Download
memory/2204-143-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2204-145-0x00000000180F0000-0x000000001818C000-memory.dmp

Filesize
624KB

Download
memory/2204-146-0x0000000018740000-0x0000000018CE4000-memory.dmp

Filesize
5.6MB

Download
memory/4804-132-0x00000000001A0000-0x00000000011A0000-memory.dmp

Filesize
16.0MB

Download
memory/4804-133-0x00000000184D0000-0x00000000184F2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads