Analysis

  • max time kernel
    111s
  • max time network
    254s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-08-2023 02:11

General

  • Target

    VenomRAT_v6.0.3_WITH_SOURCE/VenomRAT v6.0.3 (SOURCE)/Stub/ClientAny.exe

  • Size

    71KB

  • MD5

    958cfc3e7730a66a05d6b8a49ce13d63

  • SHA1

    ebc55f86cccfead463fcc1e6a060a5012fb09907

  • SHA256

    eedce349ce30bae2c269040ac02e0c1d2a979cd2743dc89dc8138e61b30f1798

  • SHA512

    cd6c4f6229a5d97a9b335cbbaf16e4ceab2efde6dd6e17ea0e8645d12739bd2a7ab8e6a77887dd92894af17305df6aafd051c0bfdd8fe7965225f0d538d9fbc5

  • SSDEEP

    768:+MFJ2BAxBMXR5OavIpl2d90CfOmPiEq586H+XVhMZEILH5DMnuqUch04U0VTLgSv:HJmm+g58TXsDpUuqbdLuGjhDeVclN

Score
10/10

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 2 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\ClientAny.exe
    "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\ClientAny.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4364
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4364 -s 956
      2⤵
      • Program crash
      PID:336
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 408 -p 4364 -ip 4364
    1⤵
      PID:4360

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4364-134-0x0000000000900000-0x0000000000918000-memory.dmp

      Filesize

      96KB

    • memory/4364-136-0x00007FF8C18E0000-0x00007FF8C23A1000-memory.dmp

      Filesize

      10.8MB

    • memory/4364-137-0x000000001B5A0000-0x000000001B5B0000-memory.dmp

      Filesize

      64KB

    • memory/4364-138-0x00007FF8C18E0000-0x00007FF8C23A1000-memory.dmp

      Filesize

      10.8MB