asyncrat | 901aae7ee066f4bae3b555b70100669c065a41c9bf7003e539f0967dab0148e0

Analysis

max time kernel
30s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2022 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

csgoaimbotv4.exe
Size

128KB
MD5

1ea71f05dfcf204b93d5cb477b4f2204
SHA1

e6c7fef434465cee12997728b3f524c9240e9da4
SHA256

cda8e1419b737a89a7e5b6d90d9586538bf4d3316ca86c7b32b26b6993435aa5
SHA512

d2b10b215dd01b2c33e0b32e0f2d156997d9cfd58d7ce96509e2453c869ae87190f89585311462e0195e2f0794d2d53e8316df4aef52b8cc01bd970c61a7d739
SSDEEP

3072:ubhIBLTM3Ufc6dZi4M8Gbb9y+z3SVD5OG005SlkzTeL9BJiXvzcprrC:MhALTM3Uf9O8kbpq5BKN

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

127.0.0.1:8080

griffins.hopto.org:8080

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/4288-132-0x0000000000620000-0x0000000000646000-memory.dmp	asyncrat
behavioral1/files/0x000300000001e74b-135.dat	asyncrat
behavioral1/files/0x000300000001e74b-136.dat	asyncrat
behavioral1/memory/5012-137-0x0000000000870000-0x0000000000886000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
5012	frk.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	csgoaimbotv4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	csgoaimbotv4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5012	frk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 5012	4288	csgoaimbotv4.exe	78
PID 4288 wrote to memory of 5012	4288	csgoaimbotv4.exe	78

C:\Users\Admin\AppData\Local\Temp\csgoaimbotv4.exe
"C:\Users\Admin\AppData\Local\Temp\csgoaimbotv4.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Local\Temp\frk.exe
  "C:\Users\Admin\AppData\Local\Temp\frk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\frk.exe

Filesize
63KB

MD5
591d3f16704f236e4837ca2cd59a7fd8

SHA1
039be17f0176a87ac249424074db8582f9317682

SHA256
220bcd7d2ae4d3f9e8d438aa49578e5b552ce46550f183c6c0e7e30cf5be14a1

SHA512
a4ce6f418d8c058982d7502cd66b87ec9197ce8f22075046cb0f33ce3645c82db7537f019215df726181bd4a19b16ac37efa92abcffc6029228c5cbb6ff04cb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\frk.exe

Filesize
63KB

MD5
591d3f16704f236e4837ca2cd59a7fd8

SHA1
039be17f0176a87ac249424074db8582f9317682

SHA256
220bcd7d2ae4d3f9e8d438aa49578e5b552ce46550f183c6c0e7e30cf5be14a1

SHA512
a4ce6f418d8c058982d7502cd66b87ec9197ce8f22075046cb0f33ce3645c82db7537f019215df726181bd4a19b16ac37efa92abcffc6029228c5cbb6ff04cb5

Download Submit
memory/4288-132-0x0000000000620000-0x0000000000646000-memory.dmp

Filesize
152KB

Download
memory/4288-133-0x00007FF8A1A30000-0x00007FF8A24F1000-memory.dmp

Filesize
10.8MB

Download
memory/4288-138-0x00007FF8A1A30000-0x00007FF8A24F1000-memory.dmp

Filesize
10.8MB

Download
memory/5012-137-0x0000000000870000-0x0000000000886000-memory.dmp

Filesize
88KB

Download
memory/5012-139-0x00007FF8A1A30000-0x00007FF8A24F1000-memory.dmp

Filesize
10.8MB

Download
memory/5012-140-0x00007FF8A1A30000-0x00007FF8A24F1000-memory.dmp

Filesize
10.8MB

Download