Analysis
-
max time kernel
29s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-06-2023 10:58
Behavioral task
behavioral1
Sample
c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe
-
Size
74KB
-
MD5
4c479566473499949657c49a04f56822
-
SHA1
ad4522e154a6926728939503763786e8898b745d
-
SHA256
c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28
-
SHA512
62f9d72d5955e367268a462f0110e9a3fd6db57987541b89c64e619a3ef77b1af56f66f449496ea4b64a27d76c4932760b364ee035f08950aae6efde81305401
-
SSDEEP
1536:SUvQcxyN1hJC1GPMVNedj/aLEgIPH1br/JIH9AQzcGLVclN:SUYcxyNl+GPMVO/vVH1brBIHmQfBY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.1
Botnet
new rai tay
C2
144.202.52.245:4449
Mutex
clfdboaluvjjxdlt
Attributes
-
delay
1
-
install
true
-
install_file
kyovn.exe
-
install_folder
%Temp%
aes.plain
Signatures
-
Async RAT payload 2 IoCs
resource yara_rule behavioral1/memory/1236-54-0x0000000000040000-0x0000000000058000-memory.dmp asyncrat behavioral1/memory/1236-56-0x000000001B180000-0x000000001B200000-memory.dmp asyncrat -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeIncreaseQuotaPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSecurityPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeTakeOwnershipPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeLoadDriverPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSystemProfilePrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSystemtimePrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeProfSingleProcessPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeIncBasePriorityPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeCreatePagefilePrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeBackupPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeRestorePrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeShutdownPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeDebugPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSystemEnvironmentPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeRemoteShutdownPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeUndockPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeManageVolumePrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: 33 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: 34 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: 35 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeIncreaseQuotaPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSecurityPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeTakeOwnershipPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeLoadDriverPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSystemProfilePrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSystemtimePrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeProfSingleProcessPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeIncBasePriorityPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeCreatePagefilePrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeBackupPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeRestorePrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeShutdownPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeDebugPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSystemEnvironmentPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeRemoteShutdownPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeUndockPrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeManageVolumePrivilege 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: 33 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: 34 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: 35 1236 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe