Analysis

  • max time kernel
    113s
  • max time network
    253s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-08-2023 02:11

General

  • Target

    VenomRAT_v6.0.3_WITH_SOURCE/VenomRAT v6.0.3 (SOURCE)/Stub/Clientx86.exe

  • Size

    71KB

  • MD5

    9e58447fdcf9d7625879dc2f8e51d41e

  • SHA1

    2b64506b4f318a4154f51dec8db498b0ca2f075b

  • SHA256

    fb646f0abb2d769531bdcbbb33c15b8d65a2f948a9b027005a007f1ae7fb6d23

  • SHA512

    bcf6ec720c1d8e7e3608453f05626db9569b32448c53520b52c143c1da6e5c015105d57dccaf6b47bfd37fa757a91cfa647c7e5832a7d52b8eb0bb6955615fbf

  • SSDEEP

    768:j2FJ2BAxBMXR5OavIpl2d90CfOm3iEq586H+XVhMxEILH5DMnuqkch04U0VTLgSy:gJmm+I58TXsLpUuqrdLuGjhsuVclN

Score
10/10

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\Clientx86.exe
    "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\Clientx86.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2472
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 1020
      2⤵
      • Program crash
      PID:1716
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2472 -ip 2472
    1⤵
      PID:4776

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2472-134-0x0000000000D60000-0x0000000000D78000-memory.dmp

      Filesize

      96KB

    • memory/2472-133-0x0000000074CD0000-0x0000000075480000-memory.dmp

      Filesize

      7.7MB

    • memory/2472-135-0x0000000005E50000-0x00000000063F4000-memory.dmp

      Filesize

      5.6MB

    • memory/2472-137-0x0000000005890000-0x00000000058A0000-memory.dmp

      Filesize

      64KB

    • memory/2472-138-0x0000000074CD0000-0x0000000075480000-memory.dmp

      Filesize

      7.7MB