Analysis
- max time kernel
139s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
- submitted
24/11/2023, 23:01
General
- Target 6490d278311b6f31e3a2fc4c879495d6fc576747c51d65ff1fcab58832829c22.exe
- Size 4.9MB
- Sample231124-2zzd9aeh37
- SHA256 6490d278311b6f31e3a2fc4c879495d6fc576747c51d65ff1fcab58832829c22
Malware Config
Extracted
-
asyncrat
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
-
Default
-
113.207.105.241:9803
-
piwskfforojhkyre
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6490d278311b6f31e3a2fc4c879495d6fc576747c51d65ff1fcab58832829c22.exe"C:\Users\Admin\AppData\Local\Temp\6490d278311b6f31e3a2fc4c879495d6fc576747c51d65ff1fcab58832829c22.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4268-8-0x0000000003C80000-0x0000000003C9C000-memory.dmp
memory/4268-9-0x0000000073740000-0x0000000073EF0000-memory.dmp
memory/4268-11-0x0000000006430000-0x0000000006440000-memory.dmp
memory/4268-10-0x0000000006370000-0x0000000006388000-memory.dmp
memory/4268-12-0x00000000069F0000-0x0000000006F94000-memory.dmp
memory/4268-14-0x0000000006430000-0x0000000006440000-memory.dmp
memory/4268-15-0x00000000776F1000-0x00000000776F2000-memory.dmp
memory/4268-16-0x0000000007040000-0x00000000070D2000-memory.dmp
memory/4268-17-0x0000000007000000-0x000000000700A000-memory.dmp
memory/4268-18-0x00000000073B0000-0x000000000744C000-memory.dmp
memory/4268-19-0x0000000007450000-0x00000000074B6000-memory.dmp
memory/4268-21-0x0000000006430000-0x0000000006440000-memory.dmp
memory/4268-22-0x0000000073740000-0x0000000073EF0000-memory.dmp
memory/4268-23-0x0000000006430000-0x0000000006440000-memory.dmp
memory/4268-24-0x0000000006430000-0x0000000006440000-memory.dmp
memory/4268-25-0x0000000006430000-0x0000000006440000-memory.dmp
memory/4268-26-0x0000000006430000-0x0000000006440000-memory.dmp