Analysis
-
max time kernel
128s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
-
submitted
05-12-2023 16:49
General
-
Target
538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe
-
Size
216KB
-
MD5
bad1cdd965e866302bfbbbc2a169fd29
-
SHA1
450a46eb04d12aee2301bb78d3f6ce7f99fe1cc7
-
SHA256
538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc
-
SHA512
d0a60fe0d003bd424bce2d54a5b2d5a6d104e9771e2de2007ade371a72b7e95e2f7146e4434f8282516ceb4919ae50bfc185ec372df5b62064e78396521e9872
-
SSDEEP
6144:dyM5XnCIPRFewED7QtJiR5VL+AwOrwgXdbhw166PR:kM5XnCIpVE6JiNLfwOrwLPR
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
8.130.84.209:4449
Mutex
ytgqvkeijwgcw
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe"C:\Users\Admin\AppData\Local\Temp\538898db1be8c6ce5a8d8fd0163ba3968ef350b2f09521348c79ca480b6e52dc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2024-0-0x0000000000090000-0x00000000000AC000-memory.dmpFilesize
112KB
-
memory/2024-4-0x0000000004B90000-0x0000000004BD0000-memory.dmpFilesize
256KB
-
memory/2024-3-0x0000000004B90000-0x0000000004BD0000-memory.dmpFilesize
256KB
-
memory/2024-2-0x0000000073F40000-0x000000007462E000-memory.dmpFilesize
6.9MB
-
memory/2024-1-0x00000000008F0000-0x0000000000908000-memory.dmpFilesize
96KB
-
memory/2024-6-0x0000000073F40000-0x000000007462E000-memory.dmpFilesize
6.9MB
-
memory/2024-7-0x0000000004B90000-0x0000000004BD0000-memory.dmpFilesize
256KB