Analysis
- max time kernel
146s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
- submitted
16/05/2024, 14:54
General
- Target 84c2b21f5b3c48dfb7481094b8e7f8c2f56e041fe3244b1a608bc264d83536bb.exe
- Size 11.7MB
- Sample240516-r96afaaa67
- SHA256 84c2b21f5b3c48dfb7481094b8e7f8c2f56e041fe3244b1a608bc264d83536bb
Malware Config
Extracted
-
asyncrat
-
Venom RAT + HVNC + Stealer + Grabber v6.0.2
-
Default
-
94.156.69.161:8900
-
94.156.69.161:4443
-
94.156.69.163:8900
-
94.156.69.163:4443
-
94.156.69.164:8900
-
94.156.69.164:4443
-
94.156.69.165:8900
-
94.156.69.165:4443
-
94.156.69.166:8900
-
94.156.69.166:4443
-
91.92.248.82:8900
-
91.92.248.82:4443
-
91.92.251.136:8900
-
91.92.251.136:4443
-
91.92.251.153:8900
-
91.92.251.153:4443
-
91.92.251.159:8900
-
91.92.251.159:4443
-
91.92.251.179:8900
-
91.92.251.179:4443
-
sqhylkrhlwjrecxiv
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\84c2b21f5b3c48dfb7481094b8e7f8c2f56e041fe3244b1a608bc264d83536bb.exe"C:\Users\Admin\AppData\Local\Temp\84c2b21f5b3c48dfb7481094b8e7f8c2f56e041fe3244b1a608bc264d83536bb.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1296-0-0x000000007519E000-0x000000007519F000-memory.dmp
memory/1296-1-0x0000000000670000-0x0000000001234000-memory.dmp
memory/1296-2-0x0000000006320000-0x00000000068C6000-memory.dmp
memory/1296-3-0x0000000005D70000-0x0000000005E02000-memory.dmp
memory/1296-4-0x0000000005D20000-0x0000000005D2A000-memory.dmp
memory/1296-5-0x0000000075190000-0x0000000075941000-memory.dmp
memory/1296-6-0x0000000008870000-0x00000000089F8000-memory.dmp
memory/1296-8-0x0000000008A00000-0x0000000008DFE000-memory.dmp
memory/1296-14-0x0000000075190000-0x0000000075941000-memory.dmp
memory/5068-13-0x0000000075190000-0x0000000075941000-memory.dmp
memory/5068-11-0x0000000075190000-0x0000000075941000-memory.dmp
memory/5068-9-0x0000000000400000-0x0000000000418000-memory.dmp
memory/5068-15-0x0000000075190000-0x0000000075941000-memory.dmp
memory/5068-18-0x0000000006CC0000-0x0000000006D5C000-memory.dmp
memory/5068-19-0x00000000068E0000-0x0000000006946000-memory.dmp
memory/5068-21-0x0000000075190000-0x0000000075941000-memory.dmp
memory/5068-22-0x0000000075190000-0x0000000075941000-memory.dmp
memory/5068-23-0x0000000075190000-0x0000000075941000-memory.dmp
memory/5068-24-0x0000000075190000-0x0000000075941000-memory.dmp
memory/5068-25-0x0000000075190000-0x0000000075941000-memory.dmp