Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13-10-2023 22:28
General
-
Target
4b3b7f44832cc0cf1b84469ce06c7d11f1a82e5d532374e29736c3bfd94055c7.exe
-
Size
65KB
-
MD5
09487f556205dcd31cc9b0ba3be1394a
-
SHA1
1576c8b6eb67135d62a2687f0436e470b87c5fd2
-
SHA256
4b3b7f44832cc0cf1b84469ce06c7d11f1a82e5d532374e29736c3bfd94055c7
-
SHA512
c84aee2073429c7c2d427eaf040e0d80c21f093e0ec4c4143b6bbf2d17ade3889dfe218850dcae2116a291096b8aa184433597c455970e552702f70601b763f0
-
SSDEEP
1536:CZn6AVsIQ9HJfxQ7CqmB9x1bbsTxRYrS7+asNNpqKmY7:CZn1Q95x/q8n1bbsTorQKNWz
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
VenomRAT_HVNC 5.0.4
Botnet
Venom Clients
C2
127.0.0.1:4444
Mutex
8mgklCdM2
Attributes
-
delay
0
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b3b7f44832cc0cf1b84469ce06c7d11f1a82e5d532374e29736c3bfd94055c7.exe"C:\Users\Admin\AppData\Local\Temp\4b3b7f44832cc0cf1b84469ce06c7d11f1a82e5d532374e29736c3bfd94055c7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB