Analysis

  • max time kernel
    310s
  • max time network
    207s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19-04-2024 20:37

General

  • Target

    C11Bootstrapper/Properties/C11Setup.exe

  • Size

    252KB

  • MD5

    c23a7c501e475f0065efdc9775890deb

  • SHA1

    adc0d1bb12657bd6ca4354399cbfab7b9ad9cd45

  • SHA256

    b57490326cb83aaf68d2ddfd95655b89387956100c5d09c8fcd4fa50e54fb5c4

  • SHA512

    f6374e254a5ccad62549b235b4c66ef6164cfc34fd91d9ca545d44dce87c3d78984759e858d5eae796f8a096f91cf3fe5f0e1255660b00b1ece430e82af539c7

  • SSDEEP

    3072:yURcxONo2PMVI+DdH1bsv8eOQbR7c2ytBcL5BdkwvTkmEdxkY:yEo2PMVPdVbSOkWwvqdK

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4449

Mutex

chhphkahmfnasuyziqc

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %Temp%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Suspicious behavior: EnumeratesProcesses 63 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4084-0-0x0000000000AE0000-0x0000000000B24000-memory.dmp

    Filesize

    272KB

  • memory/4084-2-0x00007FFD72150000-0x00007FFD72C12000-memory.dmp

    Filesize

    10.8MB

  • memory/4084-3-0x000000001B880000-0x000000001B890000-memory.dmp

    Filesize

    64KB

  • memory/4084-4-0x00007FFD92FA0000-0x00007FFD931A9000-memory.dmp

    Filesize

    2.0MB

  • memory/4084-5-0x00007FFD72150000-0x00007FFD72C12000-memory.dmp

    Filesize

    10.8MB

  • memory/4084-6-0x00007FFD92FA0000-0x00007FFD931A9000-memory.dmp

    Filesize

    2.0MB