Analysis
-
max time kernel
93s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
09-07-2024 21:36
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win10-20240611-en
windows10-1703-x64
2 signatures
300 seconds
Behavioral task
behavioral2
Sample
svchost.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
300 seconds
General
-
Target
svchost.exe
-
Size
74KB
-
MD5
448cbe8cec4c7d504c610b5ca27abd8e
-
SHA1
a09cc4e4356409b5046d93aa5fdc5027dfa1a3a8
-
SHA256
901a229ea78c23e31b3b020651b48f3b8f8bbe52ebe7a97d0de91d14fb6b0271
-
SHA512
5721ad606fdcfdd5629e67aeba2a912d70c916d43c2931348dd03fcf77fa91653c845aa4899c3bc512ce89c110abb454e588aebde902cc1918ed7e79d15ed968
-
SSDEEP
1536:OUKkcx9pXCTyPMV3IrEI1H1bw/Rs9+QzcOLVclN:OUDcx958yPMV3IzH1bwpsAQHBY
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
147.185.221.20:49485
Mutex
RANDOM-SHIT
Attributes
-
delay
3
-
install
true
-
install_file
svchost.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2068 svchost.exe Token: SeIncreaseQuotaPrivilege 2068 svchost.exe Token: SeSecurityPrivilege 2068 svchost.exe Token: SeTakeOwnershipPrivilege 2068 svchost.exe Token: SeLoadDriverPrivilege 2068 svchost.exe Token: SeSystemProfilePrivilege 2068 svchost.exe Token: SeSystemtimePrivilege 2068 svchost.exe Token: SeProfSingleProcessPrivilege 2068 svchost.exe Token: SeIncBasePriorityPrivilege 2068 svchost.exe Token: SeCreatePagefilePrivilege 2068 svchost.exe Token: SeBackupPrivilege 2068 svchost.exe Token: SeRestorePrivilege 2068 svchost.exe Token: SeShutdownPrivilege 2068 svchost.exe Token: SeDebugPrivilege 2068 svchost.exe Token: SeSystemEnvironmentPrivilege 2068 svchost.exe Token: SeRemoteShutdownPrivilege 2068 svchost.exe Token: SeUndockPrivilege 2068 svchost.exe Token: SeManageVolumePrivilege 2068 svchost.exe Token: 33 2068 svchost.exe Token: 34 2068 svchost.exe Token: 35 2068 svchost.exe Token: 36 2068 svchost.exe Token: SeIncreaseQuotaPrivilege 2068 svchost.exe Token: SeSecurityPrivilege 2068 svchost.exe Token: SeTakeOwnershipPrivilege 2068 svchost.exe Token: SeLoadDriverPrivilege 2068 svchost.exe Token: SeSystemProfilePrivilege 2068 svchost.exe Token: SeSystemtimePrivilege 2068 svchost.exe Token: SeProfSingleProcessPrivilege 2068 svchost.exe Token: SeIncBasePriorityPrivilege 2068 svchost.exe Token: SeCreatePagefilePrivilege 2068 svchost.exe Token: SeBackupPrivilege 2068 svchost.exe Token: SeRestorePrivilege 2068 svchost.exe Token: SeShutdownPrivilege 2068 svchost.exe Token: SeDebugPrivilege 2068 svchost.exe Token: SeSystemEnvironmentPrivilege 2068 svchost.exe Token: SeRemoteShutdownPrivilege 2068 svchost.exe Token: SeUndockPrivilege 2068 svchost.exe Token: SeManageVolumePrivilege 2068 svchost.exe Token: 33 2068 svchost.exe Token: 34 2068 svchost.exe Token: 35 2068 svchost.exe Token: 36 2068 svchost.exe