Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2024, 15:42
Static task
static1
Behavioral task
behavioral1
Sample
b96617d3f0379867e608596d1b6e693df7e47c00cdf110afdd10aafd2c73c64a.exe
Resource
win7-20231215-en
General
-
Target
b96617d3f0379867e608596d1b6e693df7e47c00cdf110afdd10aafd2c73c64a.exe
-
Size
2.3MB
-
MD5
f6a81f998b26e4a794dbadf68e9e1c29
-
SHA1
fb0283c1a9391ea0f5b9a06fb6d8c25576cc092e
-
SHA256
b96617d3f0379867e608596d1b6e693df7e47c00cdf110afdd10aafd2c73c64a
-
SHA512
849516c7472da3af30079662942a79688427cf9751054038b295e9c3b3245b7becf6253e391658bf9c941e4d71237072234619cb8ab054342cd4e438a6ce6ee6
-
SSDEEP
24576:Ajwl9ci18naBG2WpTQphI74yYakhlniiHFBgXemj:A09ciCnaBwp8jacNvBg
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
198.44.167.231:38795
198.44.167.231:57321
198.44.167.231:41352
198.44.167.139:38795
198.44.167.139:57321
198.44.167.139:41352
198.44.167.215:38795
198.44.167.215:57321
198.44.167.215:41352
slabhoiizjia
-
delay
30
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 2 IoCs
resource yara_rule behavioral2/memory/1136-3-0x0000000062E90000-0x0000000062EAE000-memory.dmp asyncrat behavioral2/memory/1136-11-0x0000000062F30000-0x0000000062F40000-memory.dmp asyncrat -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1136 b96617d3f0379867e608596d1b6e693df7e47c00cdf110afdd10aafd2c73c64a.exe 1136 b96617d3f0379867e608596d1b6e693df7e47c00cdf110afdd10aafd2c73c64a.exe 1136 b96617d3f0379867e608596d1b6e693df7e47c00cdf110afdd10aafd2c73c64a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1136 b96617d3f0379867e608596d1b6e693df7e47c00cdf110afdd10aafd2c73c64a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1136 b96617d3f0379867e608596d1b6e693df7e47c00cdf110afdd10aafd2c73c64a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b96617d3f0379867e608596d1b6e693df7e47c00cdf110afdd10aafd2c73c64a.exe"C:\Users\Admin\AppData\Local\Temp\b96617d3f0379867e608596d1b6e693df7e47c00cdf110afdd10aafd2c73c64a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1136