Analysis
-
max time kernel
33s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2024 06:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
mrr.exe
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
mrr.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
mrr.exe
-
Size
364KB
-
MD5
20ed4eced64d1b806ceb823c135d1d33
-
SHA1
88afb4f4c0490d8ab1a2c7f31f5e5f5114d4b70d
-
SHA256
40134b68bf863594a5a030a9c961a4b87b405424ecaf4c8df7de7e47811f30c8
-
SHA512
8c1810f16ea1822130774741d1c4b8789aaec50d0a2f5db60e263a154c488b065ca2f427b7b76b74da7a6742aa0fe6f282275199a53f27803128db811f8fac8e
-
SSDEEP
6144:MmBy5jGDw2bay5eLOi6+zgH6561uOlMH9O1BNI:MQy5jGfbaDaza561XlMo7I
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
5.0.5
Botnet
Venom Clients
C2
ujhn.duckdns.org:8520
Mutex
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1824 created 3504 1824 mrr.exe 56 -
Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/456-2-0x0000012CB2210000-0x0000012CB2226000-memory.dmp family_asyncrat -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1824 mrr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1824 mrr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 456 notepad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85 PID 1824 wrote to memory of 456 1824 mrr.exe 85
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\mrr.exe"C:\Users\Admin\AppData\Local\Temp\mrr.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1824
-
-
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:456
-