Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01/06/2023, 19:45
Behavioral task
behavioral1
Sample
4c479566473499949657c49a04f56822.exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4c479566473499949657c49a04f56822.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
4c479566473499949657c49a04f56822.exe
-
Size
74KB
-
MD5
4c479566473499949657c49a04f56822
-
SHA1
ad4522e154a6926728939503763786e8898b745d
-
SHA256
c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28
-
SHA512
62f9d72d5955e367268a462f0110e9a3fd6db57987541b89c64e619a3ef77b1af56f66f449496ea4b64a27d76c4932760b364ee035f08950aae6efde81305401
-
SSDEEP
1536:SUvQcxyN1hJC1GPMVNedj/aLEgIPH1br/JIH9AQzcGLVclN:SUYcxyNl+GPMVO/vVH1brBIHmQfBY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.1
Botnet
new rai tay
C2
144.202.52.245:4449
Mutex
clfdboaluvjjxdlt
Attributes
-
delay
1
-
install
true
-
install_file
kyovn.exe
-
install_folder
%Temp%
aes.plain
Signatures
-
Async RAT payload 2 IoCs
resource yara_rule behavioral1/memory/932-54-0x0000000000E20000-0x0000000000E38000-memory.dmp asyncrat behavioral1/memory/932-56-0x000000001AF30000-0x000000001AFB0000-memory.dmp asyncrat -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeIncreaseQuotaPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeSecurityPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeTakeOwnershipPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeLoadDriverPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeSystemProfilePrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeSystemtimePrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeProfSingleProcessPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeIncBasePriorityPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeCreatePagefilePrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeBackupPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeRestorePrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeShutdownPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeDebugPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeSystemEnvironmentPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeRemoteShutdownPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeUndockPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeManageVolumePrivilege 932 4c479566473499949657c49a04f56822.exe Token: 33 932 4c479566473499949657c49a04f56822.exe Token: 34 932 4c479566473499949657c49a04f56822.exe Token: 35 932 4c479566473499949657c49a04f56822.exe Token: SeIncreaseQuotaPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeSecurityPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeTakeOwnershipPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeLoadDriverPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeSystemProfilePrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeSystemtimePrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeProfSingleProcessPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeIncBasePriorityPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeCreatePagefilePrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeBackupPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeRestorePrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeShutdownPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeDebugPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeSystemEnvironmentPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeRemoteShutdownPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeUndockPrivilege 932 4c479566473499949657c49a04f56822.exe Token: SeManageVolumePrivilege 932 4c479566473499949657c49a04f56822.exe Token: 33 932 4c479566473499949657c49a04f56822.exe Token: 34 932 4c479566473499949657c49a04f56822.exe Token: 35 932 4c479566473499949657c49a04f56822.exe