Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
12-12-2023 15:27
General
-
Target
tmp.exe
-
Size
74KB
-
MD5
74bae7aac1e952c4aacda6e5861bdea5
-
SHA1
e5c8542cd384de64dd99b096ffdaa633e8f2edb6
-
SHA256
26c9a1df0b429d6dfe09dd2bc84a61eada354d0c27959c3f486c8d94c7dbc1f2
-
SHA512
b1a5b8930bc8e5917ad6a3b4535d8a972ccce18a46d51dfcc7650f76438499b73f24f5c7f9ee76e53546d96a75f0187ac6a2514fa00d5965324e521b1eb43260
-
SSDEEP
1536:8UUPcxVteCW7PMVee9VdQuDI6H1bf/64kQzcBLVclN:8UmcxV4x7PMVee9VdQsH1bfS4kQYBY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
103.161.112.130:4449
Mutex
wwfmnfhzdxvizy
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB