Overview

overview

10

Static

static

10

Rat2222.exe

windows7-x64

10

Rat2222.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    20-07-2024 11:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Rat2222.exe

  • Size

    73KB

  • MD5

    4a540ddfe8301f190f1562071851cbef

  • SHA1

    733f4781ca2aba8255619bfc758fa67e88d410ea

  • SHA256

    db3ea1dab8411c6d7409f85e51b7e6a009a91951b8a5a30e6a67abbeb375b811

  • SHA512

    64254eb649774d04db2e31d481ff24310bbf8ab837944fe881d5e10516c0c4162da59cfa4969f7902a28b670c2848b6290a5dbfc8092eb2772ba3c06690c5c55

  • SSDEEP

    1536:RUKkcx9pXCTyPMV/Fqiev5WI7H1bJ/tMnQzcF6VclNi:RUDcx958yPMV9qzpH1bJGQoIYY

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4449

Mutex

asdasdas

Attributes
  • delay

    1

  • install

    true

  • install_file

    sasdasd.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Rat2222.exe
    "C:\Users\Admin\AppData\Local\Temp\Rat2222.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "sasdasd" /tr '"C:\Users\Admin\AppData\Roaming\sasdasd.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2240
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "sasdasd" /tr '"C:\Users\Admin\AppData\Roaming\sasdasd.exe"'
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2428
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp4125.tmp.bat""
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:2700
      • C:\Users\Admin\AppData\Roaming\sasdasd.exe
        "C:\Users\Admin\AppData\Roaming\sasdasd.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp4125.tmp.bat
    Filesize

    151B

    MD5

    0ce9c852e86ef0f867c3b4e7159bfa8d

    SHA1

    d2ef13b79e99f753965c408ad6505486dfb54158

    SHA256

    e913f1ee89efb034c616b1f77c61edbacf361a5d9e1d5ce2238edd55c9dbc874

    SHA512

    5f204d12d0c41c08c627a9198f55c6d9480a19d9dbd8bd70c668e6ed34b89f491381b1b382db3f53d7142269b714080817299a07be02b82da3b432365e1734e8

    Download Submit

  • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
    Filesize

    8B

    MD5

    cf759e4c5f14fe3eec41b87ed756cea8

    SHA1

    c27c796bb3c2fac929359563676f4ba1ffada1f5

    SHA256

    c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

    SHA512

    c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

    Download Submit

  • \Users\Admin\AppData\Roaming\sasdasd.exe
    Filesize

    73KB

    MD5

    4a540ddfe8301f190f1562071851cbef

    SHA1

    733f4781ca2aba8255619bfc758fa67e88d410ea

    SHA256

    db3ea1dab8411c6d7409f85e51b7e6a009a91951b8a5a30e6a67abbeb375b811

    SHA512

    64254eb649774d04db2e31d481ff24310bbf8ab837944fe881d5e10516c0c4162da59cfa4969f7902a28b670c2848b6290a5dbfc8092eb2772ba3c06690c5c55

    Download Submit

  • memory/2508-0-0x000007FEF6523000-0x000007FEF6524000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2508-1-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2508-3-0x000007FEF6520000-0x000007FEF6F0C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2508-11-0x000007FEF6520000-0x000007FEF6F0C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2508-14-0x000007FEF6520000-0x000007FEF6F0C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2744-19-0x0000000000140000-0x0000000000156000-memory.dmp

    Filesize

    88KB

    Download