Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
07-12-2023 14:30
Static task
static1
Behavioral task
behavioral1
Sample
b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
Resource
win7-20231023-en
General
-
Target
b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
-
Size
1.5MB
-
MD5
4a0c109685f96e28d58cec6de029c90f
-
SHA1
d3db248232a07177f445d47a00cc2916ce4ae5e4
-
SHA256
b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6
-
SHA512
7795466bf0f3e2c308eac1debb714d11d8e1e48df36a58d83b88a2b5505ea7e40cbae3426d93e3d8b75fffcbe02d5aba92c3458737f75299734b1612b9be8a5e
-
SSDEEP
49152:uyWIUOkqL4nXl3eYegYQ7JXbZqg/DpXenFE3350wplxg9R+l3:oIUOkHnV3eYegYQ7JXb88pXenwJdplxX
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
113.207.105.229:7302
muwxyalvhydrtjh
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2864-19-0x00000000023B0000-0x00000000023C8000-memory.dmp asyncrat behavioral1/memory/2864-82-0x00000000049F0000-0x0000000004A30000-memory.dmp asyncrat -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exepid process 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exedescription pid process Token: SeDebugPrivilege 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exepid process 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe"C:\Users\Admin\AppData\Local\Temp\b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD50fa7c50d76daa379523170797943b730
SHA1ef89893a468154a41c904044865b39c55c271976
SHA25632912c510dffe8f034c6b6e0a6bb817f8f618cff5de8fe9a69c07d7ea477ee26
SHA512ca30cfde5b128f13df8ba7f2ebf86c4f15ac626b3127227dfb5c59e97817ccca443d806c366514a1b660081d74f9ac791d4f819185d7ac7f1698f7c4812f6de2
-
C:\Users\Admin\AppData\Local\Temp\CabECC1.tmpFilesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
C:\Users\Admin\AppData\Local\Temp\Tar586.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
memory/2864-16-0x0000000000590000-0x00000000005AC000-memory.dmpFilesize
112KB
-
memory/2864-17-0x0000000072E90000-0x000000007357E000-memory.dmpFilesize
6.9MB
-
memory/2864-18-0x00000000049F0000-0x0000000004A30000-memory.dmpFilesize
256KB
-
memory/2864-19-0x00000000023B0000-0x00000000023C8000-memory.dmpFilesize
96KB
-
memory/2864-21-0x0000000077120000-0x0000000077121000-memory.dmpFilesize
4KB
-
memory/2864-81-0x0000000072E90000-0x000000007357E000-memory.dmpFilesize
6.9MB
-
memory/2864-82-0x00000000049F0000-0x0000000004A30000-memory.dmpFilesize
256KB