Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
10-01-2024 21:28
General
-
Target
163.5.169.28/fd1.exe
-
Size
649KB
-
MD5
b9a42052c81229de87b90370c7e8ef56
-
SHA1
8253ef8fe65f68ea7e0cc11bcdc06ec91c8d3290
-
SHA256
2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b
-
SHA512
0e6a1b3d66c2401f8b8d5f8b2cae7d4912fa73565faf4c21686caa63a0d81eda952d6070edb57e7577c15c896caff3e52a6671713cfaa13ed21bab7accb86755
-
SSDEEP
12288:tOSF/ZdMP5WlYj6Fs/HI6C96D7cyTZ33a33S333333dkS9Jy9:tLrMPkDFB6+2NkeO
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.2
Botnet
Default
C2
5.182.87.154:4449
Mutex
jiqsvporltpvroy
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\163.5.169.28\fd1.exe"C:\Users\Admin\AppData\Local\Temp\163.5.169.28\fd1.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\163.5.169.28\fd1.exeC:\Users\Admin\AppData\Local\Temp\163.5.169.28\fd1.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672KB
-
Filesize
10.8MB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
304KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB