Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 00:59
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20240221-en
General
-
Target
Client.exe
-
Size
74KB
-
MD5
feb7c3f368154a08ad7e52261979c08e
-
SHA1
2131d762af7a5658ae4300082cbbfc61e5c42225
-
SHA256
d17e143abae10ae5cd25c20e711365eb23b4c96cf0c03d09779faf8770d4c023
-
SHA512
2a2c5abe02366fbbc632032391573e0c674136148cfed6968a02b2318cbabbd2c0e5395c3cd3179aaa25670300b5a071842c4b31423c24b87e657fc4c1210734
-
SSDEEP
1536:iUKUcxoyR1CriPMVie9VdQuDI6H1bf/guQzcuLVclN:iUzcxoyXkiPMVie9VdQsH1bf7QnBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
66.66.146.74:9511
ftjoxyioflhynjghiu
-
delay
1
-
install
true
-
install_file
svchost.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x002f000000016576-17.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 1648 svchost.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2604 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2596 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2120 Client.exe 2120 Client.exe 2120 Client.exe 2120 Client.exe 2120 Client.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe 1648 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2120 Client.exe Token: SeDebugPrivilege 1648 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1648 svchost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2136 2120 Client.exe 28 PID 2120 wrote to memory of 2136 2120 Client.exe 28 PID 2120 wrote to memory of 2136 2120 Client.exe 28 PID 2120 wrote to memory of 2652 2120 Client.exe 30 PID 2120 wrote to memory of 2652 2120 Client.exe 30 PID 2120 wrote to memory of 2652 2120 Client.exe 30 PID 2136 wrote to memory of 2604 2136 cmd.exe 32 PID 2136 wrote to memory of 2604 2136 cmd.exe 32 PID 2136 wrote to memory of 2604 2136 cmd.exe 32 PID 2652 wrote to memory of 2596 2652 cmd.exe 33 PID 2652 wrote to memory of 2596 2652 cmd.exe 33 PID 2652 wrote to memory of 2596 2652 cmd.exe 33 PID 2652 wrote to memory of 1648 2652 cmd.exe 34 PID 2652 wrote to memory of 1648 2652 cmd.exe 34 PID 2652 wrote to memory of 1648 2652 cmd.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
PID:2604
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp65C5.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2596
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1648
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
151B
MD5b14f172724424e3b85947bac8ce55804
SHA179835fefd1bde609cf47489329d7241becaccf2d
SHA2562a4e94427f73d7e859c7ea793eedb7f0ee075b161c289bfdd321e7739933560b
SHA5120f8360da64bd93d620150e3233c87e86fcc6fa29625e2ac64fc4d84de3678d639c8a08a12752ec18651280b1e8d9e82958f9375c662d2031b71f1b6030b45fdc
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
74KB
MD5feb7c3f368154a08ad7e52261979c08e
SHA12131d762af7a5658ae4300082cbbfc61e5c42225
SHA256d17e143abae10ae5cd25c20e711365eb23b4c96cf0c03d09779faf8770d4c023
SHA5122a2c5abe02366fbbc632032391573e0c674136148cfed6968a02b2318cbabbd2c0e5395c3cd3179aaa25670300b5a071842c4b31423c24b87e657fc4c1210734