Analysis
-
max time kernel
92s -
max time network
298s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27-01-2024 12:48
Behavioral task
behavioral1
Sample
é.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
300 seconds
General
-
Target
é.exe
-
Size
63KB
-
MD5
2458e5b5c876b22ddd78f1ba728b0485
-
SHA1
7864df317a205c2a7377c2b85ed6110c6a6c39d2
-
SHA256
57974fba44a21ddaeb5164b12323132a6a0057a212e05fa75a2610d4cd52b23e
-
SHA512
3a15c862cb69f68fba8faf7a5745d2aa28eb1ca3307d8fec780fa3d1a60cc9200639f8b757b4ac3f0f4c5e672e0bdf0f01dabe24a6697cd2c0b72b1096fbff7d
-
SSDEEP
1536:AhIBLTM3Ufc0cMdp6um5WlGbbYwWB5z4tGGDpqKmY7:AhIBLTM3Ufc6dNmkGbbY1z4Jgz
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
5.0.5
Botnet
Venom Clients
C2
127.0.0.1:4449
176.150.69.221:4449
Mutex
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/4028-0-0x0000000000770000-0x0000000000786000-memory.dmp asyncrat behavioral1/memory/4028-7-0x00000000028C0000-0x00000000028D0000-memory.dmp asyncrat behavioral1/memory/4028-12-0x0000000002860000-0x0000000002870000-memory.dmp asyncrat behavioral1/memory/4028-14-0x000000001B3F0000-0x000000001B400000-memory.dmp asyncrat -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
é.exepid process 4028 é.exe 4028 é.exe 4028 é.exe 4028 é.exe 4028 é.exe 4028 é.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
é.exedescription pid process Token: SeDebugPrivilege 4028 é.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
é.exepid process 4028 é.exe 4028 é.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4028-0-0x0000000000770000-0x0000000000786000-memory.dmpFilesize
88KB
-
memory/4028-1-0x00007FFB48510000-0x00007FFB48FD1000-memory.dmpFilesize
10.8MB
-
memory/4028-2-0x000000001B3F0000-0x000000001B400000-memory.dmpFilesize
64KB
-
memory/4028-3-0x00007FFB663B0000-0x00007FFB665A5000-memory.dmpFilesize
2.0MB
-
memory/4028-6-0x000000001CCB0000-0x000000001CD26000-memory.dmpFilesize
472KB
-
memory/4028-7-0x00000000028C0000-0x00000000028D0000-memory.dmpFilesize
64KB
-
memory/4028-8-0x000000001CC30000-0x000000001CC4E000-memory.dmpFilesize
120KB
-
memory/4028-9-0x00007FFB48510000-0x00007FFB48FD1000-memory.dmpFilesize
10.8MB
-
memory/4028-10-0x000000001B3F0000-0x000000001B400000-memory.dmpFilesize
64KB
-
memory/4028-11-0x00007FFB663B0000-0x00007FFB665A5000-memory.dmpFilesize
2.0MB
-
memory/4028-12-0x0000000002860000-0x0000000002870000-memory.dmpFilesize
64KB
-
memory/4028-13-0x000000001B3F0000-0x000000001B400000-memory.dmpFilesize
64KB
-
memory/4028-14-0x000000001B3F0000-0x000000001B400000-memory.dmpFilesize
64KB
-
memory/4028-15-0x000000001B3F0000-0x000000001B400000-memory.dmpFilesize
64KB
-
memory/4028-16-0x000000001B3F0000-0x000000001B400000-memory.dmpFilesize
64KB
-
memory/4028-17-0x000000001B3F0000-0x000000001B400000-memory.dmpFilesize
64KB