Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-04-2023 04:48
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20230220-en
General
-
Target
Client.exe
-
Size
74KB
-
MD5
3566c4f706bbebb67878a461e23dc196
-
SHA1
988d9336640ae8c8f59d7ee40e5cbb01a72f47a5
-
SHA256
3b475cf40bdd62b35e9804b7cb8dafbe706e6dde37780dc6d0dbba22caf20d2c
-
SHA512
9c00a17b07896307af56b229587158babdd50ae2bae7564c4cf7f18ad326d4617e4a0fba4ad49a603fc10cc505e057bf9fe492645bc97b3bc2d45e927f361fe0
-
SSDEEP
1536:hUjacx+pEgCC8PMVHe9VdQuDI6H1bf/CBQQzcyLVclN:hUGcx+Dt8PMVHe9VdQsH1bf6yQjBY
Malware Config
Extracted
asyncrat
Venom Pwn3rzs' Edtition v6.0.1
2023
85.192.40.255:4449
dsyuvsavyiusayviolusayiulvasikuviu
-
delay
1
-
install
true
-
install_file
fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1220-54-0x0000000000A00000-0x0000000000A18000-memory.dmp asyncrat behavioral1/memory/1220-56-0x000000001A770000-0x000000001A7F0000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe asyncrat C:\Users\Admin\AppData\Roaming\fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe asyncrat behavioral1/memory/1784-69-0x0000000000360000-0x0000000000378000-memory.dmp asyncrat behavioral1/memory/1784-71-0x000000001AEC0000-0x000000001AF40000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exepid process 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2040 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Client.exefuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exepid process 1220 Client.exe 1220 Client.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Client.exefuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exedescription pid process Token: SeDebugPrivilege 1220 Client.exe Token: SeDebugPrivilege 1220 Client.exe Token: SeDebugPrivilege 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe Token: SeDebugPrivilege 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exepid process 1784 fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Client.execmd.execmd.exedescription pid process target process PID 1220 wrote to memory of 580 1220 Client.exe cmd.exe PID 1220 wrote to memory of 580 1220 Client.exe cmd.exe PID 1220 wrote to memory of 580 1220 Client.exe cmd.exe PID 1220 wrote to memory of 268 1220 Client.exe cmd.exe PID 1220 wrote to memory of 268 1220 Client.exe cmd.exe PID 1220 wrote to memory of 268 1220 Client.exe cmd.exe PID 580 wrote to memory of 944 580 cmd.exe schtasks.exe PID 580 wrote to memory of 944 580 cmd.exe schtasks.exe PID 580 wrote to memory of 944 580 cmd.exe schtasks.exe PID 268 wrote to memory of 2040 268 cmd.exe timeout.exe PID 268 wrote to memory of 2040 268 cmd.exe timeout.exe PID 268 wrote to memory of 2040 268 cmd.exe timeout.exe PID 268 wrote to memory of 1784 268 cmd.exe fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe PID 268 wrote to memory of 1784 268 cmd.exe fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe PID 268 wrote to memory of 1784 268 cmd.exe fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg" /tr '"C:\Users\Admin\AppData\Roaming\fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg" /tr '"C:\Users\Admin\AppData\Roaming\fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8528.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe"C:\Users\Admin\AppData\Roaming\fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
C:\Users\Admin\AppData\Local\Temp\TarC96F.tmpFilesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
C:\Users\Admin\AppData\Local\Temp\tmp8528.tmp.batFilesize
218B
MD5efbe485e99af10c7778ad623cde6ed6d
SHA14cb219d078c630eb289a81837a4e80a5fd9134dd
SHA256f773fa7b364ebf150287e3a04f53e56b4fe00c8971cd11cbf1101a74cf46dcfb
SHA51202cfda509daa4d1e97d827bd2810d7f3bb7fee78bfedc1447faa994db3ffc6c8372c25b9ca342e5f49ef43ae51c0177ad823fb1b92ab4b336d69ba3444197516
-
C:\Users\Admin\AppData\Local\Temp\tmp8528.tmp.batFilesize
218B
MD5efbe485e99af10c7778ad623cde6ed6d
SHA14cb219d078c630eb289a81837a4e80a5fd9134dd
SHA256f773fa7b364ebf150287e3a04f53e56b4fe00c8971cd11cbf1101a74cf46dcfb
SHA51202cfda509daa4d1e97d827bd2810d7f3bb7fee78bfedc1447faa994db3ffc6c8372c25b9ca342e5f49ef43ae51c0177ad823fb1b92ab4b336d69ba3444197516
-
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.confFilesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
C:\Users\Admin\AppData\Roaming\fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exeFilesize
74KB
MD53566c4f706bbebb67878a461e23dc196
SHA1988d9336640ae8c8f59d7ee40e5cbb01a72f47a5
SHA2563b475cf40bdd62b35e9804b7cb8dafbe706e6dde37780dc6d0dbba22caf20d2c
SHA5129c00a17b07896307af56b229587158babdd50ae2bae7564c4cf7f18ad326d4617e4a0fba4ad49a603fc10cc505e057bf9fe492645bc97b3bc2d45e927f361fe0
-
C:\Users\Admin\AppData\Roaming\fuikvhafdjkbvjksfdbjhkshdfkjbhajdkfbjkhdsagfhjdsajbgdjhksfagbhjikdfsgjhbkg.exeFilesize
74KB
MD53566c4f706bbebb67878a461e23dc196
SHA1988d9336640ae8c8f59d7ee40e5cbb01a72f47a5
SHA2563b475cf40bdd62b35e9804b7cb8dafbe706e6dde37780dc6d0dbba22caf20d2c
SHA5129c00a17b07896307af56b229587158babdd50ae2bae7564c4cf7f18ad326d4617e4a0fba4ad49a603fc10cc505e057bf9fe492645bc97b3bc2d45e927f361fe0
-
memory/1220-54-0x0000000000A00000-0x0000000000A18000-memory.dmpFilesize
96KB
-
memory/1220-56-0x000000001A770000-0x000000001A7F0000-memory.dmpFilesize
512KB
-
memory/1784-69-0x0000000000360000-0x0000000000378000-memory.dmpFilesize
96KB
-
memory/1784-71-0x000000001AEC0000-0x000000001AF40000-memory.dmpFilesize
512KB
-
memory/1784-109-0x000000001AEC0000-0x000000001AF40000-memory.dmpFilesize
512KB