Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Client.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    1800s
  • max time network
    1797s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18/07/2024, 00:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client.exe

  • Size

    74KB

  • MD5

    96c4bbad5dcf2b198bdb2e14776cd941

  • SHA1

    de397813a1d1dc708f7d9353a1720c1573ff1584

  • SHA256

    617d6c2325ae7aaa8bd8a123657c5fa88f54ae9d342177e534163245483ed9d3

  • SHA512

    6b56df779dda44e5aae45bea2882de5f7408cc8ea9738adc902081735354fe14d3148702b5fad78e31b1f9bd25269d5ab5f792ea3e347a09892bb99fbb78babf

  • SSDEEP

    1536:pUk0cxVGlCBiPMVye9VdQuDI6H1bf//9hQzcwSVclN:pURcxVMWiPMVye9VdQsH1bfNhQFwY

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

mvbqdiwiakl

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/LwwcrLg4

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2272
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
      PID:4332
    • C:\Windows\System32\SystemSettingsBroker.exe
      C:\Windows\System32\SystemSettingsBroker.exe -Embedding
      1⤵
        PID:4120
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
        1⤵
          PID:4320
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k localservice -s SstpSvc
          1⤵
            PID:1884
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
            1⤵
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:2860
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
            1⤵
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            PID:3456
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s RasMan
            1⤵
              PID:1204
            • C:\Windows\system32\control.exe
              "C:\Windows\system32\control.exe" netconnections
              1⤵
              • Modifies registry class
              PID:380
            • \??\c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s Netman
              1⤵
              • Modifies data under HKEY_USERS
              PID:3936
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k netsvcs -s NetSetupSvc
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1644
            • \??\c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s RasMan
              1⤵
                PID:4800
              • \??\c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s RasMan
                1⤵
                  PID:3220

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Windows\INF\netrasa.PNF
                  Filesize

                  22KB

                  MD5

                  80648b43d233468718d717d10187b68d

                  SHA1

                  a1736e8f0e408ce705722ce097d1adb24ebffc45

                  SHA256

                  8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

                  SHA512

                  eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

                  Download Submit

                • C:\Windows\INF\netsstpa.PNF
                  Filesize

                  6KB

                  MD5

                  01e21456e8000bab92907eec3b3aeea9

                  SHA1

                  39b34fe438352f7b095e24c89968fca48b8ce11c

                  SHA256

                  35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

                  SHA512

                  9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

                  Download Submit

                • memory/380-15-0x0000017874890000-0x0000017874B43000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/2272-0-0x0000000000070000-0x0000000000088000-memory.dmp

                  Filesize

                  96KB

                  Download

                • memory/2272-1-0x00007FFB3FAC3000-0x00007FFB3FAC4000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2272-3-0x00007FFB3FAC0000-0x00007FFB404AC000-memory.dmp

                  Filesize

                  9.9MB

                  Download

                • memory/2272-4-0x00007FFB3FAC0000-0x00007FFB404AC000-memory.dmp

                  Filesize

                  9.9MB

                  Download

                • memory/2272-5-0x00007FFB3FAC3000-0x00007FFB3FAC4000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2272-6-0x00007FFB3FAC0000-0x00007FFB404AC000-memory.dmp

                  Filesize

                  9.9MB

                  Download

                • memory/2272-7-0x00007FFB3FAC0000-0x00007FFB404AC000-memory.dmp

                  Filesize

                  9.9MB

                  Download