Analysis
-
max time kernel
127s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20230831-en -
resource tags
arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system -
submitted
03-09-2023 21:59
Static task
static1
Behavioral task
behavioral1
Sample
60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe
Resource
win7-20230831-en
General
-
Target
60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe
-
Size
221KB
-
MD5
822db4ce5eacc545f78f1654602dd6cd
-
SHA1
ce486832f4e9d9953d9f534000094ee8dff184c5
-
SHA256
60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f
-
SHA512
c7e23a517b97c41e98889c2ae1827a25deec106b21e212c9e159d99df304d67279992615e66b837014b8febc3235d3e4f113747b48b5793f69f4ed1793da54e3
-
SSDEEP
6144:jM0gW20h3UJ6Q23E2pgkwhsIatqO5CFFJatz8NTZUEPZwBVI5HIcrFuBxm:jM0gW20h3UJ6Q23E2pgkwhsIatqO5CFe
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.1
installs
185.183.33.129:4449
dfmsnnvbfsar
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1320-13-0x0000000000400000-0x0000000000418000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exedescription pid process target process PID 2244 set thread context of 1320 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exeInstallUtil.exepid process 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe 1320 InstallUtil.exe 1320 InstallUtil.exe 1320 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe Token: SeDebugPrivilege 1320 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 1320 InstallUtil.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exedescription pid process target process PID 2244 wrote to memory of 1940 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 2244 wrote to memory of 1940 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 2244 wrote to memory of 1940 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 2244 wrote to memory of 1940 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 2244 wrote to memory of 1940 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 2244 wrote to memory of 1940 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 2244 wrote to memory of 1940 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 2244 wrote to memory of 1940 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 2244 wrote to memory of 1320 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 2244 wrote to memory of 1320 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 2244 wrote to memory of 1320 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 2244 wrote to memory of 1320 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 2244 wrote to memory of 1320 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 2244 wrote to memory of 1320 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 2244 wrote to memory of 1320 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe PID 2244 wrote to memory of 1320 2244 60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe"C:\Users\Admin\AppData\Local\Temp\60e4798e89505978388a3cb83f6ff42c1436240dde097bbaf0fc7482bee2e00f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1320-13-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1320-25-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/1320-24-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/1320-23-0x0000000073920000-0x000000007400E000-memory.dmpFilesize
6.9MB
-
memory/1320-22-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/1320-20-0x0000000005F00000-0x0000000005F66000-memory.dmpFilesize
408KB
-
memory/1320-19-0x000000007773F000-0x0000000077740000-memory.dmpFilesize
4KB
-
memory/1320-18-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/1320-16-0x0000000073920000-0x000000007400E000-memory.dmpFilesize
6.9MB
-
memory/2244-10-0x0000000004EE0000-0x0000000004EF0000-memory.dmpFilesize
64KB
-
memory/2244-7-0x0000000008390000-0x0000000008422000-memory.dmpFilesize
584KB
-
memory/2244-11-0x0000000008650000-0x000000000866A000-memory.dmpFilesize
104KB
-
memory/2244-12-0x0000000005B20000-0x0000000005B26000-memory.dmpFilesize
24KB
-
memory/2244-9-0x0000000073920000-0x000000007400E000-memory.dmpFilesize
6.9MB
-
memory/2244-8-0x0000000008360000-0x000000000836A000-memory.dmpFilesize
40KB
-
memory/2244-15-0x0000000073920000-0x000000007400E000-memory.dmpFilesize
6.9MB
-
memory/2244-0-0x0000000000CE0000-0x0000000000D1E000-memory.dmpFilesize
248KB
-
memory/2244-6-0x0000000008690000-0x0000000008B8E000-memory.dmpFilesize
5.0MB
-
memory/2244-5-0x0000000005960000-0x00000000059A0000-memory.dmpFilesize
256KB
-
memory/2244-4-0x0000000004EE0000-0x0000000004EF0000-memory.dmpFilesize
64KB
-
memory/2244-3-0x0000000004A60000-0x0000000004DB0000-memory.dmpFilesize
3.3MB
-
memory/2244-2-0x0000000004980000-0x0000000004A1C000-memory.dmpFilesize
624KB
-
memory/2244-1-0x0000000073920000-0x000000007400E000-memory.dmpFilesize
6.9MB