Analysis
- max time kernel
92s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
16/04/2024, 17:29
General
- Target 4232-132-0x0000000008050000-0x0000000008068000-memory.exe
- Size 96KB
- Sample240416-v21xjagb53
- SHA256 d641e1f4f2f9cdfdf1ff6e7d1e33e0e7cefa08b00c473ecee6e4825e557dc5fe
Malware Config
Extracted
-
asyncrat
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
-
Default
-
194.48.251.169:4449
-
wmdekgrrot
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4232-132-0x0000000008050000-0x0000000008068000-memory.exe"C:\Users\Admin\AppData\Local\Temp\4232-132-0x0000000008050000-0x0000000008068000-memory.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4192-0-0x0000000000400000-0x0000000000418000-memory.dmp
memory/4192-2-0x00007FF887250000-0x00007FF887D11000-memory.dmp
memory/4192-3-0x000000001B160000-0x000000001B170000-memory.dmp
memory/4192-4-0x000000001B160000-0x000000001B170000-memory.dmp
memory/4192-6-0x00007FF887250000-0x00007FF887D11000-memory.dmp
memory/4192-7-0x000000001B160000-0x000000001B170000-memory.dmp
memory/4192-8-0x000000001B160000-0x000000001B170000-memory.dmp
memory/4192-9-0x000000001B160000-0x000000001B170000-memory.dmp