Analysis
-
max time kernel
127s -
max time network
302s -
platform
windows10-1703_x64 -
resource
win10-20230831-en -
resource tags
arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system -
submitted
02-09-2023 04:50
Static task
static1
Behavioral task
behavioral1
Sample
60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe
Resource
win7-20230831-en
General
-
Target
60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe
-
Size
221KB
-
MD5
822db4ce5eacc545f78f1654602dd6cd
-
SHA1
ce486832f4e9d9953d9f534000094ee8dff184c5
-
SHA256
60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f
-
SHA512
c7e23a517b97c41e98889c2ae1827a25deec106b21e212c9e159d99df304d67279992615e66b837014b8febc3235d3e4f113747b48b5793f69f4ed1793da54e3
-
SSDEEP
6144:jM0gW20h3UJ6Q23E2pgkwhsIatqO5CFFJatz8NTZUEPZwBVI5HIcrFuBxm:jM0gW20h3UJ6Q23E2pgkwhsIatqO5CFe
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.1
installs
185.183.33.129:4449
dfmsnnvbfsar
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3956-13-0x0000000000400000-0x0000000000418000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exedescription pid process target process PID 5116 set thread context of 3956 5116 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exeInstallUtil.exepid process 5116 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe 3956 InstallUtil.exe 3956 InstallUtil.exe 3956 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 5116 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe Token: SeDebugPrivilege 3956 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 3956 InstallUtil.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exedescription pid process target process PID 5116 wrote to memory of 3956 5116 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 5116 wrote to memory of 3956 5116 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 5116 wrote to memory of 3956 5116 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 5116 wrote to memory of 3956 5116 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 5116 wrote to memory of 3956 5116 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 5116 wrote to memory of 3956 5116 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 5116 wrote to memory of 3956 5116 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 5116 wrote to memory of 3956 5116 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe"C:\Users\Admin\AppData\Local\Temp\60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3956-13-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3956-24-0x0000000004E90000-0x0000000004EA0000-memory.dmpFilesize
64KB
-
memory/3956-23-0x0000000073F90000-0x000000007467E000-memory.dmpFilesize
6.9MB
-
memory/3956-21-0x0000000004E90000-0x0000000004EA0000-memory.dmpFilesize
64KB
-
memory/3956-20-0x0000000006080000-0x00000000060E6000-memory.dmpFilesize
408KB
-
memory/3956-19-0x0000000077DAF000-0x0000000077DB0000-memory.dmpFilesize
4KB
-
memory/3956-17-0x0000000004E90000-0x0000000004EA0000-memory.dmpFilesize
64KB
-
memory/3956-15-0x0000000073F90000-0x000000007467E000-memory.dmpFilesize
6.9MB
-
memory/5116-10-0x0000000005270000-0x0000000005280000-memory.dmpFilesize
64KB
-
memory/5116-18-0x0000000073F90000-0x000000007467E000-memory.dmpFilesize
6.9MB
-
memory/5116-0-0x00000000008D0000-0x000000000090E000-memory.dmpFilesize
248KB
-
memory/5116-11-0x0000000009E40000-0x0000000009E5A000-memory.dmpFilesize
104KB
-
memory/5116-12-0x00000000064E0000-0x00000000064E6000-memory.dmpFilesize
24KB
-
memory/5116-8-0x0000000008C70000-0x0000000008C7A000-memory.dmpFilesize
40KB
-
memory/5116-7-0x0000000008C90000-0x0000000008D22000-memory.dmpFilesize
584KB
-
memory/5116-9-0x0000000073F90000-0x000000007467E000-memory.dmpFilesize
6.9MB
-
memory/5116-6-0x0000000008F60000-0x000000000945E000-memory.dmpFilesize
5.0MB
-
memory/5116-5-0x0000000006320000-0x0000000006360000-memory.dmpFilesize
256KB
-
memory/5116-4-0x0000000005270000-0x0000000005280000-memory.dmpFilesize
64KB
-
memory/5116-3-0x0000000005350000-0x00000000056A0000-memory.dmpFilesize
3.3MB
-
memory/5116-2-0x00000000052B0000-0x000000000534C000-memory.dmpFilesize
624KB
-
memory/5116-1-0x0000000073F90000-0x000000007467E000-memory.dmpFilesize
6.9MB