Analysis

  • max time kernel
    120s
  • max time network
    307s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-08-2023 02:11

General

  • Target

    VenomRAT_v6.0.3_WITH_SOURCE/VenomRAT v6.0.3 (SOURCE)/Stub/Clientx64.exe

  • Size

    71KB

  • MD5

    33aa30124ec0b36f1a9319cd62a11e84

  • SHA1

    f8181335be708048b28cf1540054a5dd9d6acf8c

  • SHA256

    c6a8838b3619db76fc89af6bbd9188f868557348b3d06e2815eae2882dae8ec3

  • SHA512

    fceed2946791b47eb3e9f5b94fb11104abdc6bd8c2ae3c4c4694880af168608822a0b77ceecaeda125a04ffe2fcc081bf0e003c17ba3dc34a6ad261d45da7e65

  • SSDEEP

    768:aEFJ2BAxBMXR5OavIpl2d90CfOmfiEq586H+XVhMxEILH5DMnuqLch04U0VTLgSS:LJmm+A58TXsLpUuqudLuGjhMCVclN

Score
10/10

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\Clientx64.exe
    "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\Clientx64.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4924
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4924 -s 952
      2⤵
      • Program crash
      PID:4912
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 420 -p 4924 -ip 4924
    1⤵
      PID:2852

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4924-133-0x0000000000820000-0x0000000000838000-memory.dmp

      Filesize

      96KB

    • memory/4924-135-0x00007FFD23880000-0x00007FFD24341000-memory.dmp

      Filesize

      10.8MB

    • memory/4924-136-0x000000001B4C0000-0x000000001B4D0000-memory.dmp

      Filesize

      64KB

    • memory/4924-137-0x00007FFD23880000-0x00007FFD24341000-memory.dmp

      Filesize

      10.8MB