Analysis
- max time kernel
145s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
01/04/2024, 19:38
General
- Target 1111.exe
- Size 74KB
- Sample240401-ycqbaaeb37
- SHA256 6d5f011818216b2ca1be9392d63df67ceec685e5d3f3cb04d25b3a0b08e0b297
Malware Config
Extracted
-
asyncrat
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
-
Default
-
kesdxbsykaxfnxcy
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/vDUK0mVG
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1111.exe"C:\Users\Admin\AppData\Local\Temp\1111.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp64D0.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmp64D0.tmp.bat
memory/2312-14-0x000000001B220000-0x000000001B230000-memory.dmp
memory/2312-15-0x000000001B220000-0x000000001B230000-memory.dmp
memory/2312-4-0x00007FFCA5410000-0x00007FFCA5605000-memory.dmp
memory/2312-0-0x00000000002A0000-0x00000000002B8000-memory.dmp
memory/2312-8-0x000000001B220000-0x000000001B230000-memory.dmp
memory/2312-10-0x00007FFC87130000-0x00007FFC87BF1000-memory.dmp
memory/2312-11-0x000000001C660000-0x000000001C6D6000-memory.dmp
memory/2312-12-0x000000001AFE0000-0x000000001AFF0000-memory.dmp
memory/2312-3-0x000000001B220000-0x000000001B230000-memory.dmp
memory/2312-13-0x000000001B010000-0x000000001B02E000-memory.dmp
memory/2312-7-0x000000001B220000-0x000000001B230000-memory.dmp
memory/2312-16-0x00007FFCA5410000-0x00007FFCA5605000-memory.dmp
memory/2312-17-0x000000001B220000-0x000000001B230000-memory.dmp
memory/2312-18-0x000000001B220000-0x000000001B230000-memory.dmp
memory/2312-19-0x000000001B220000-0x000000001B230000-memory.dmp
memory/2312-20-0x0000000000A90000-0x0000000000AF6000-memory.dmp
memory/2312-2-0x00007FFC87130000-0x00007FFC87BF1000-memory.dmp
memory/2312-25-0x00007FFC87130000-0x00007FFC87BF1000-memory.dmp
memory/2312-26-0x00007FFCA5410000-0x00007FFCA5605000-memory.dmp