Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 17:35
Behavioral task
behavioral1
Sample
ClientAny.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
ClientAny.exe
-
Size
74KB
-
MD5
48865d6cc53e8a2fc637da9f1ee5e353
-
SHA1
d655c548c01f91438d20f80bd9acab9f94073cef
-
SHA256
243107799d46411f4a919d7117eef4b5f1718dc997bf9ef316ed822ea93b29e8
-
SHA512
acd3920bbb859c8e27334977cf7b5ec1bb035c38e1203cf40aea4caf33e4dcf8b3ac5e754d7a63973ec56186f3f2484530e897e58b4da169df34b1e469f78940
-
SSDEEP
1536:LUk0cxVGlCBiPMVQ0JpsIyb1bu/MIomRQzc+LVclN:LURcxVMWiPMVz/4b1bukIo+QXBY
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
Mutex
kjllrkvvfowjke
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/zAGEXn7M
aes.plain
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 48 IoCs
Processes:
flow ioc 103 pastebin.com 33 pastebin.com 34 pastebin.com 57 pastebin.com 68 pastebin.com 74 pastebin.com 89 pastebin.com 97 pastebin.com 30 pastebin.com 31 pastebin.com 44 pastebin.com 88 pastebin.com 98 pastebin.com 100 pastebin.com 66 pastebin.com 91 pastebin.com 95 pastebin.com 48 pastebin.com 56 pastebin.com 58 pastebin.com 71 pastebin.com 77 pastebin.com 102 pastebin.com 72 pastebin.com 73 pastebin.com 92 pastebin.com 96 pastebin.com 99 pastebin.com 101 pastebin.com 43 pastebin.com 55 pastebin.com 67 pastebin.com 70 pastebin.com 83 pastebin.com 90 pastebin.com 94 pastebin.com 11 pastebin.com 21 pastebin.com 23 pastebin.com 32 pastebin.com 53 pastebin.com 10 pastebin.com 22 pastebin.com 37 pastebin.com 52 pastebin.com 54 pastebin.com 69 pastebin.com 93 pastebin.com -
Suspicious behavior: EnumeratesProcesses 49 IoCs
Processes:
ClientAny.exepid process 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe 4068 ClientAny.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ClientAny.exedescription pid process Token: SeDebugPrivilege 4068 ClientAny.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ClientAny.exepid process 4068 ClientAny.exe