Analysis
-
max time kernel
152s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
30-08-2023 06:55
Behavioral task
behavioral1
Sample
c10fcea2721002bd22ed2d3b7572b50d.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
c10fcea2721002bd22ed2d3b7572b50d.exe
Resource
win10v2004-20230703-en
General
-
Target
c10fcea2721002bd22ed2d3b7572b50d.exe
-
Size
68KB
-
MD5
c10fcea2721002bd22ed2d3b7572b50d
-
SHA1
2d27c6a7591e6280b34349d58ec615e9509ab2cd
-
SHA256
240c710c0e9ac872803407490fd60e67ec7bc970326f8938608320ccee52e36a
-
SHA512
745ade289f0f51a925e413de11fc5962d583987e039069a2c52415da358eb294633eef310b6b484bd7515ee385eb5db873924cd6a95e5e759f0dd4178e4e1ae6
-
SSDEEP
1536:XhSjnRQ/kVJmV/WeeiIVrGbbXw2XslYGFqopqKmY7:XhSjnRQ/kVC/PeXGbbXoHqzz
Malware Config
Extracted
asyncrat
5.0.5
Venom Clients
138.197.66.62:22596
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
true
-
install_file
Game GTA.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2584-0-0x00000000001A0000-0x00000000001B8000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\Game GTA.exe asyncrat C:\Users\Admin\AppData\Roaming\Game GTA.exe asyncrat behavioral1/memory/2864-18-0x00000000009C0000-0x00000000009D8000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
Game GTA.exepid process 2864 Game GTA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2944 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c10fcea2721002bd22ed2d3b7572b50d.exepid process 2584 c10fcea2721002bd22ed2d3b7572b50d.exe 2584 c10fcea2721002bd22ed2d3b7572b50d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
c10fcea2721002bd22ed2d3b7572b50d.exeGame GTA.exedescription pid process Token: SeDebugPrivilege 2584 c10fcea2721002bd22ed2d3b7572b50d.exe Token: SeDebugPrivilege 2864 Game GTA.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
c10fcea2721002bd22ed2d3b7572b50d.execmd.execmd.exedescription pid process target process PID 2584 wrote to memory of 1960 2584 c10fcea2721002bd22ed2d3b7572b50d.exe cmd.exe PID 2584 wrote to memory of 1960 2584 c10fcea2721002bd22ed2d3b7572b50d.exe cmd.exe PID 2584 wrote to memory of 1960 2584 c10fcea2721002bd22ed2d3b7572b50d.exe cmd.exe PID 2584 wrote to memory of 2804 2584 c10fcea2721002bd22ed2d3b7572b50d.exe cmd.exe PID 2584 wrote to memory of 2804 2584 c10fcea2721002bd22ed2d3b7572b50d.exe cmd.exe PID 2584 wrote to memory of 2804 2584 c10fcea2721002bd22ed2d3b7572b50d.exe cmd.exe PID 1960 wrote to memory of 2852 1960 cmd.exe schtasks.exe PID 1960 wrote to memory of 2852 1960 cmd.exe schtasks.exe PID 1960 wrote to memory of 2852 1960 cmd.exe schtasks.exe PID 2804 wrote to memory of 2944 2804 cmd.exe timeout.exe PID 2804 wrote to memory of 2944 2804 cmd.exe timeout.exe PID 2804 wrote to memory of 2944 2804 cmd.exe timeout.exe PID 2804 wrote to memory of 2864 2804 cmd.exe Game GTA.exe PID 2804 wrote to memory of 2864 2804 cmd.exe Game GTA.exe PID 2804 wrote to memory of 2864 2804 cmd.exe Game GTA.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c10fcea2721002bd22ed2d3b7572b50d.exe"C:\Users\Admin\AppData\Local\Temp\c10fcea2721002bd22ed2d3b7572b50d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Game GTA" /tr '"C:\Users\Admin\AppData\Roaming\Game GTA.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Game GTA" /tr '"C:\Users\Admin\AppData\Roaming\Game GTA.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpC1D9.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Game GTA.exe"C:\Users\Admin\AppData\Roaming\Game GTA.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC1D9.tmp.batFilesize
152B
MD5530fe6a15916cf3a90d0805bcdd8d628
SHA16d424fb140c41219eba0b58ad26231319d8fd9c3
SHA2568bc6807cba96b9aa05d3f5284e0f032bab420124692ebbcad5ab11a773fcc47e
SHA5129fe0273712d88a8afe984493bb0ced55740ef2cdf4b2bd0d95eb6534c00d2947138c44054120bc5454c4fc43f5fe75372e2422df65720e9f7726bf41e71ada84
-
C:\Users\Admin\AppData\Local\Temp\tmpC1D9.tmp.batFilesize
152B
MD5530fe6a15916cf3a90d0805bcdd8d628
SHA16d424fb140c41219eba0b58ad26231319d8fd9c3
SHA2568bc6807cba96b9aa05d3f5284e0f032bab420124692ebbcad5ab11a773fcc47e
SHA5129fe0273712d88a8afe984493bb0ced55740ef2cdf4b2bd0d95eb6534c00d2947138c44054120bc5454c4fc43f5fe75372e2422df65720e9f7726bf41e71ada84
-
C:\Users\Admin\AppData\Roaming\Game GTA.exeFilesize
68KB
MD5c10fcea2721002bd22ed2d3b7572b50d
SHA12d27c6a7591e6280b34349d58ec615e9509ab2cd
SHA256240c710c0e9ac872803407490fd60e67ec7bc970326f8938608320ccee52e36a
SHA512745ade289f0f51a925e413de11fc5962d583987e039069a2c52415da358eb294633eef310b6b484bd7515ee385eb5db873924cd6a95e5e759f0dd4178e4e1ae6
-
C:\Users\Admin\AppData\Roaming\Game GTA.exeFilesize
68KB
MD5c10fcea2721002bd22ed2d3b7572b50d
SHA12d27c6a7591e6280b34349d58ec615e9509ab2cd
SHA256240c710c0e9ac872803407490fd60e67ec7bc970326f8938608320ccee52e36a
SHA512745ade289f0f51a925e413de11fc5962d583987e039069a2c52415da358eb294633eef310b6b484bd7515ee385eb5db873924cd6a95e5e759f0dd4178e4e1ae6
-
memory/2584-13-0x00000000778B0000-0x0000000077A59000-memory.dmpFilesize
1.7MB
-
memory/2584-12-0x000007FEF5B90000-0x000007FEF657C000-memory.dmpFilesize
9.9MB
-
memory/2584-3-0x00000000778B0000-0x0000000077A59000-memory.dmpFilesize
1.7MB
-
memory/2584-1-0x000007FEF5B90000-0x000007FEF657C000-memory.dmpFilesize
9.9MB
-
memory/2584-0-0x00000000001A0000-0x00000000001B8000-memory.dmpFilesize
96KB
-
memory/2584-2-0x000000001AB30000-0x000000001ABB0000-memory.dmpFilesize
512KB
-
memory/2864-18-0x00000000009C0000-0x00000000009D8000-memory.dmpFilesize
96KB
-
memory/2864-19-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmpFilesize
9.9MB
-
memory/2864-20-0x000000001A760000-0x000000001A7E0000-memory.dmpFilesize
512KB
-
memory/2864-21-0x00000000778B0000-0x0000000077A59000-memory.dmpFilesize
1.7MB
-
memory/2864-22-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmpFilesize
9.9MB
-
memory/2864-23-0x000000001A760000-0x000000001A7E0000-memory.dmpFilesize
512KB
-
memory/2864-24-0x00000000778B0000-0x0000000077A59000-memory.dmpFilesize
1.7MB