asyncrat | 929b11e9d778f3fb3753f2bfec104862dd325bd91546afc7dfe15803d1726a13 | Triage

Analysis

max time kernel
29s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 21:42

Sharing

Report Analysis Logs

General

Target

VenomRAT/Stub/Client.exe
Size

63KB
MD5

6158c0682f86511060619bba0fe864be
SHA1

63a1738c87ba9449b1d572ee470da2b242742643
SHA256

5bf4fc2c4d3115229d60511cad1af48019a4c291ad6144e73393e88e319f80a5
SHA512

baef40b589d8717f419185ad0885173f790394827d72d78520890ae737c7ee1cebe3af062340847cfe705c223669562e7116f48ab11d59654653a0b269026bd1
SSDEEP

1536:8WP+BbY58krxvI0TTCNsOoIK7q6LgRAIM8pqKmY7:8WP+BbY5xrxvI0Z7P8R8Xz

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/2444-132-0x00000000007E0000-0x00000000007F6000-memory.dmp	asyncrat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4988	2444	WerFault.exe	77

C:\Users\Admin\AppData\Local\Temp\VenomRAT\Stub\Client.exe
"C:\Users\Admin\AppData\Local\Temp\VenomRAT\Stub\Client.exe"
1⤵
PID:2444
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2444 -s 740
  2⤵
  - Program crash
  PID:4988

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 2444 -ip 2444
1⤵
PID:4420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2444-132-0x00000000007E0000-0x00000000007F6000-memory.dmp

Filesize
88KB

Download
memory/2444-133-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

Filesize
10.8MB

Download
memory/2444-134-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

Filesize
10.8MB

Download