Analysis
-
max time kernel
141s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 17:40
Behavioral task
behavioral1
Sample
ClientAny.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
ClientAny.exe
-
Size
74KB
-
MD5
9dabe66b91d1121c2e4ead7f006eb095
-
SHA1
8f9be3dcf0fe25aeb9b291455199990d3d189f66
-
SHA256
1d8219f967ab56f527a176a07a91f447b7ee335103e5cbac73b1bacc03cbab4d
-
SHA512
0c65b35f59dc3dce6d4951800696573619e2e8cbff6f623f2f1d39b740eb79495515436cd82bcf38d315688f456424bd03cd8bc32fe7389eb1b5d25921bc0a31
-
SSDEEP
1536:4UUPcxVteCW7PMVgOyWIeH1bc/buLLhaQzcaLVclN:4UmcxV4x7PMVLyOH1bcMLgQLBY
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
194.55.186.155:2424
Mutex
qncatmcnnrwluo
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
ClientAny.exepid process 4764 ClientAny.exe 4764 ClientAny.exe 4764 ClientAny.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ClientAny.exedescription pid process Token: SeDebugPrivilege 4764 ClientAny.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ClientAny.exepid process 4764 ClientAny.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ClientAny.exe"C:\Users\Admin\AppData\Local\Temp\ClientAny.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4764
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5084 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:864