Analysis
- max time kernel
117s - max time network
118s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
02/08/2023, 21:30
General
- Target Client.exe
- Size 74KB
- Sample230802-1cj6daaa26
- SHA256 eb945bd353aaab5149c301aa9644e5278e608f060cf09c3d06e88d6fb6b3faeb
- MD5 65a98165599217c14d3ce191cbbb9489
- SHA1 b27cac89c25b847bf69e9d245bd8828636d47963
- SHA512 1986547ca32c087bc908afccb270e76eee1c928f081097ad93126e93dd217eb945d6036a8e8a772ba4040c4add48805803532803f12f8d2f239af21baa2e30c9
- SSDEEP 1536:UU0AcxOIWC72PMV+e9VdQuDI6H1bf/rO6QzcOLVclN:UURcxONo2PMV+e9VdQsH1bfTQHBY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
-
Default
C2
-
127.0.0.1:4449
Mutex
-
tkxbghrptmqtnkssdz
Attributes
-
delay
1
-
install
false
-
install_folder
%Temp%
aes.plain
Signatures
- Async RAT payload 1 IoCs
resource yara_rule behavioral1/memory/512-133-0x0000000000A10000-0x0000000000A28000-memory.dmp asyncrat - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 512 Client.exe 512 Client.exe 512 Client.exe 512 Client.exe 2416 taskmgr.exe 2416 taskmgr.exe 512 Client.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 512 Client.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 512 Client.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 512 Client.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 512 Client.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 512 Client.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 1984 Client.exe 1984 Client.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 1984 Client.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 1984 Client.exe 2416 taskmgr.exe 2416 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2416 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 512 Client.exe Token: SeDebugPrivilege 2416 taskmgr.exe Token: SeSystemProfilePrivilege 2416 taskmgr.exe Token: SeCreateGlobalPrivilege 2416 taskmgr.exe Token: SeDebugPrivilege 1984 Client.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe 2416 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 512 Client.exe 1984 Client.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:512
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2416
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2600
-
C:\Users\Admin\Desktop\Client.exe"C:\Users\Admin\Desktop\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1984
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
- Size 8B
- SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
- MD5 cf759e4c5f14fe3eec41b87ed756cea8
- SHA1 c27c796bb3c2fac929359563676f4ba1ffada1f5
- SHA512 c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
- MD5 SHA1 SHA512