Analysis
- max time kernel
144s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231130-en - resource tags
- submitted
09/12/2023, 10:57
General
- Target d521131dfb3b6acfc91015082dadce6f3c86fc74a253fce5cd9d52211b380ebd.exe
- Size 2.6MB
- Sample231209-m2a24sgadp
- SHA256 d521131dfb3b6acfc91015082dadce6f3c86fc74a253fce5cd9d52211b380ebd
Malware Config
Extracted
-
asyncrat
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
-
Default
-
127.0.0.1:4449
-
154.23.141.66:4449
-
ydpbhrlzdntbq
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d521131dfb3b6acfc91015082dadce6f3c86fc74a253fce5cd9d52211b380ebd.exe"C:\Users\Admin\AppData\Local\Temp\d521131dfb3b6acfc91015082dadce6f3c86fc74a253fce5cd9d52211b380ebd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/652-26-0x000001EFE85B0000-0x000001EFE85C0000-memory.dmp
memory/652-42-0x000001EFF0920000-0x000001EFF0921000-memory.dmp
memory/652-45-0x000001EFF0950000-0x000001EFF0951000-memory.dmp
memory/652-46-0x000001EFF0A60000-0x000001EFF0A61000-memory.dmp
memory/652-44-0x000001EFF0950000-0x000001EFF0951000-memory.dmp
memory/4492-5-0x00000159EA160000-0x00000159EA170000-memory.dmp
memory/4492-7-0x00000159EA160000-0x00000159EA170000-memory.dmp
memory/4492-8-0x00000159EA160000-0x00000159EA170000-memory.dmp
memory/4492-6-0x00007FF935280000-0x00007FF935D41000-memory.dmp
memory/4492-4-0x00000159EA160000-0x00000159EA170000-memory.dmp
memory/4492-0-0x00000159AA540000-0x00000159AA55C000-memory.dmp
memory/4492-3-0x00007FF935280000-0x00007FF935D41000-memory.dmp
memory/4492-1-0x00000159D1800000-0x00000159D1818000-memory.dmp
memory/4516-9-0x00000180992D0000-0x0000018099404000-memory.dmp