Analysis
- max time kernel
139s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
16/08/2023, 12:33
General
- Target 8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe
- Size 7.5MB
- Sample230816-precwsag79
- SHA256 8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6
Malware Config
Extracted
-
asyncrat
-
Venom RAT + HVNC + Stealer + Grabber v6.0.1
-
Default
-
185.106.94.122:4449
-
nrasbnbyxirll
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe"C:\Users\Admin\AppData\Local\Temp\8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 26483⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3744 -ip 37441⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1736-143-0x0000000005960000-0x0000000005970000-memory.dmp
memory/1736-142-0x0000000005960000-0x0000000005970000-memory.dmp
memory/1736-135-0x0000000005FC0000-0x0000000006564000-memory.dmp
memory/1736-136-0x0000000005A10000-0x0000000005AA2000-memory.dmp
memory/1736-137-0x0000000005960000-0x0000000005970000-memory.dmp
memory/1736-138-0x0000000005990000-0x000000000599A000-memory.dmp
memory/1736-139-0x00000000070E0000-0x000000000717C000-memory.dmp
memory/1736-140-0x0000000005960000-0x0000000005970000-memory.dmp
memory/1736-141-0x0000000074DC0000-0x0000000075570000-memory.dmp
memory/1736-147-0x0000000074DC0000-0x0000000075570000-memory.dmp
memory/1736-134-0x0000000000A30000-0x00000000011B0000-memory.dmp
memory/1736-133-0x0000000074DC0000-0x0000000075570000-memory.dmp
memory/3744-144-0x0000000000400000-0x0000000000418000-memory.dmp
memory/3744-146-0x0000000074DC0000-0x0000000075570000-memory.dmp
memory/3744-149-0x0000000004D80000-0x0000000004D90000-memory.dmp
memory/3744-150-0x00000000778C1000-0x00000000778C2000-memory.dmp
memory/3744-153-0x00000000062A0000-0x0000000006306000-memory.dmp
memory/3744-154-0x0000000004D80000-0x0000000004D90000-memory.dmp
memory/3744-156-0x0000000074DC0000-0x0000000075570000-memory.dmp
memory/3744-157-0x0000000006CB0000-0x0000000006D26000-memory.dmp
memory/3744-158-0x0000000006E50000-0x0000000006E6E000-memory.dmp
memory/3744-197-0x0000000074DC0000-0x0000000075570000-memory.dmp