Analysis

  • max time kernel
    294s
  • max time network
    317s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-08-2023 02:11

General

  • Target

    VenomRAT_v6.0.3_WITH_SOURCE/VenomRAT v6.0.3 (SOURCE)/Client.exe

  • Size

    73KB

  • MD5

    5d6802a39c1bea84e1bd3e6ba23b7bbb

  • SHA1

    17b6040dcd0dc6c0cf794b6d95ed4da0f07ef0b9

  • SHA256

    d1fd56cb9943f5b185c8ee52a34f7ea4d34c5091f77ea18138f1d13a8951dd5e

  • SHA512

    55df1ab721022d363b6d454ab496b7cc542702edda0525037cc8f0c33a1d93bc50ed62be8d4b95ba1248d7fee5b806d599ddce5e3ff6a9d4464e3047a0ee799d

  • SSDEEP

    1536:LUUPcxVteCW7PMVee9VdQkhDIyH1bf/mc6QzcajVclNw:LUmcxV4x7PMVee9VdQgH1bfd6QLJY+

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

93.82.44.26:4040

Mutex

nheplizwdi

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4964-133-0x0000000000430000-0x0000000000446000-memory.dmp

    Filesize

    88KB

  • memory/4964-135-0x00007FFF85E00000-0x00007FFF868C1000-memory.dmp

    Filesize

    10.8MB

  • memory/4964-136-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

    Filesize

    64KB

  • memory/4964-137-0x00007FFF85E00000-0x00007FFF868C1000-memory.dmp

    Filesize

    10.8MB