Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
30-01-2023 19:21
General
-
Target
158162a2e1018f01bf256a2bd65882418c6b7e89.exe
-
Size
425KB
-
MD5
a023f65e2b275a6fa814b4247bd69c3b
-
SHA1
158162a2e1018f01bf256a2bd65882418c6b7e89
-
SHA256
ad784dcc210216c3cab22fa504436bab048c9555f0e79b1b51b599187c1b4e68
-
SHA512
00932a8a1439279973ec908010f75bf2cd9474e10e18c62866553039d384947d1097cb8b1081fffc8bf80a457fb298198ab0c64335d9dfe10fd6697b853c85b2
-
SSDEEP
3072:ghB5LrUwk4XVV0XjWdGbbWHCUnVHMpUzkatz:ghzLrUwk4XVqTWdkbyCUVsmQs
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
5.0.5
Botnet
Venom Clients
C2
127.0.0.1:4449
Mutex
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\158162a2e1018f01bf256a2bd65882418c6b7e89.exe"C:\Users\Admin\AppData\Local\Temp\158162a2e1018f01bf256a2bd65882418c6b7e89.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
-
Filesize
10.8MB
-
Filesize
10.8MB