Analysis
-
max time kernel
128s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system -
submitted
05-12-2023 16:49
Static task
static1
Behavioral task
behavioral1
Sample
538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe
Resource
win10v2004-20231130-en
General
-
Target
538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe
-
Size
216KB
-
MD5
bad1cdd965e866302bfbbbc2a169fd29
-
SHA1
450a46eb04d12aee2301bb78d3f6ce7f99fe1cc7
-
SHA256
538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc
-
SHA512
d0a60fe0d003bd424bce2d54a5b2d5a6d104e9771e2de2007ade371a72b7e95e2f7146e4434f8282516ceb4919ae50bfc185ec372df5b62064e78396521e9872
-
SSDEEP
6144:dyM5XnCIPRFewED7QtJiR5VL+AwOrwgXdbhw166PR:kM5XnCIpVE6JiNLfwOrwLPR
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
8.130.84.209:4449
ytgqvkeijwgcw
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2024-3-0x0000000004B90000-0x0000000004BD0000-memory.dmp asyncrat behavioral1/memory/2024-1-0x00000000008F0000-0x0000000000908000-memory.dmp asyncrat -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exepid process 2024 538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe 2024 538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe 2024 538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe 2024 538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe 2024 538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe 2024 538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe 2024 538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exedescription pid process Token: SeDebugPrivilege 2024 538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exepid process 2024 538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe"C:\Users\Admin\AppData\Local\Temp\538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2024-0-0x0000000000090000-0x00000000000AC000-memory.dmpFilesize
112KB
-
memory/2024-4-0x0000000004B90000-0x0000000004BD0000-memory.dmpFilesize
256KB
-
memory/2024-3-0x0000000004B90000-0x0000000004BD0000-memory.dmpFilesize
256KB
-
memory/2024-2-0x0000000073F40000-0x000000007462E000-memory.dmpFilesize
6.9MB
-
memory/2024-1-0x00000000008F0000-0x0000000000908000-memory.dmpFilesize
96KB
-
memory/2024-6-0x0000000073F40000-0x000000007462E000-memory.dmpFilesize
6.9MB
-
memory/2024-7-0x0000000004B90000-0x0000000004BD0000-memory.dmpFilesize
256KB