Analysis
-
max time kernel
101s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 10:58
Behavioral task
behavioral1
Sample
c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe
-
Size
74KB
-
MD5
4c479566473499949657c49a04f56822
-
SHA1
ad4522e154a6926728939503763786e8898b745d
-
SHA256
c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28
-
SHA512
62f9d72d5955e367268a462f0110e9a3fd6db57987541b89c64e619a3ef77b1af56f66f449496ea4b64a27d76c4932760b364ee035f08950aae6efde81305401
-
SSDEEP
1536:SUvQcxyN1hJC1GPMVNedj/aLEgIPH1br/JIH9AQzcGLVclN:SUYcxyNl+GPMVO/vVH1brBIHmQfBY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.1
Botnet
new rai tay
C2
144.202.52.245:4449
Mutex
clfdboaluvjjxdlt
Attributes
-
delay
1
-
install
true
-
install_file
kyovn.exe
-
install_folder
%Temp%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/1612-133-0x0000000000D50000-0x0000000000D68000-memory.dmp asyncrat -
Program crash 1 IoCs
pid pid_target Process procid_target 672 1612 WerFault.exe 84 -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeIncreaseQuotaPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSecurityPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeTakeOwnershipPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeLoadDriverPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSystemProfilePrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSystemtimePrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeProfSingleProcessPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeIncBasePriorityPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeCreatePagefilePrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeBackupPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeRestorePrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeShutdownPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeDebugPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSystemEnvironmentPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeRemoteShutdownPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeUndockPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeManageVolumePrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: 33 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: 34 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: 35 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: 36 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeIncreaseQuotaPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSecurityPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeTakeOwnershipPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeLoadDriverPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSystemProfilePrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSystemtimePrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeProfSingleProcessPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeIncBasePriorityPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeCreatePagefilePrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeBackupPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeRestorePrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeShutdownPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeDebugPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeSystemEnvironmentPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeRemoteShutdownPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeUndockPrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: SeManageVolumePrivilege 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: 33 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: 34 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: 35 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe Token: 36 1612 c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe"C:\Users\Admin\AppData\Local\Temp\c2cda600256314b688cf195f809356e2592ba8df9de9c2b1a117a0ee26ccfa28.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1612 -s 13162⤵
- Program crash
PID:672
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 440 -p 1612 -ip 16121⤵PID:1316