Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 17:35
Behavioral task
behavioral1
Sample
ClientAny.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
ClientAny.exe
-
Size
74KB
-
MD5
48865d6cc53e8a2fc637da9f1ee5e353
-
SHA1
d655c548c01f91438d20f80bd9acab9f94073cef
-
SHA256
243107799d46411f4a919d7117eef4b5f1718dc997bf9ef316ed822ea93b29e8
-
SHA512
acd3920bbb859c8e27334977cf7b5ec1bb035c38e1203cf40aea4caf33e4dcf8b3ac5e754d7a63973ec56186f3f2484530e897e58b4da169df34b1e469f78940
-
SSDEEP
1536:LUk0cxVGlCBiPMVQ0JpsIyb1bu/MIomRQzc+LVclN:LURcxVMWiPMVz/4b1bukIo+QXBY
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
Mutex
kjllrkvvfowjke
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/zAGEXn7M
aes.plain
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 47 IoCs
Processes:
flow ioc 19 pastebin.com 27 pastebin.com 35 pastebin.com 36 pastebin.com 39 pastebin.com 11 pastebin.com 28 pastebin.com 32 pastebin.com 34 pastebin.com 38 pastebin.com 4 pastebin.com 6 pastebin.com 29 pastebin.com 48 pastebin.com 49 pastebin.com 45 pastebin.com 12 pastebin.com 22 pastebin.com 26 pastebin.com 31 pastebin.com 44 pastebin.com 15 pastebin.com 33 pastebin.com 43 pastebin.com 37 pastebin.com 42 pastebin.com 46 pastebin.com 10 pastebin.com 13 pastebin.com 14 pastebin.com 17 pastebin.com 23 pastebin.com 47 pastebin.com 50 pastebin.com 20 pastebin.com 21 pastebin.com 30 pastebin.com 40 pastebin.com 41 pastebin.com 18 pastebin.com 24 pastebin.com 25 pastebin.com 5 pastebin.com 7 pastebin.com 8 pastebin.com 9 pastebin.com 16 pastebin.com -
Suspicious behavior: EnumeratesProcesses 47 IoCs
Processes:
ClientAny.exepid process 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe 2868 ClientAny.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ClientAny.exedescription pid process Token: SeDebugPrivilege 2868 ClientAny.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ClientAny.exepid process 2868 ClientAny.exe