Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
04-08-2024 19:32
Behavioral task
behavioral1
Sample
Client.exe
Resource
win10-20240611-en
General
-
Target
Client.exe
-
Size
63KB
-
MD5
730fffd38140c61bade2c837099a4f0d
-
SHA1
615a5bd706eb2676aedaa39fc6927cecef1aae29
-
SHA256
e61f184859c51a4c0213f7481455a711ea45b0c8f8ee241f1e32cb873c10fa28
-
SHA512
51b1a5f9fc240a2174cb7f6e6c2874e875b5045882a5d6e8ce3584a6e343285013be3bf9a6425e0e17f18215ae6fb574a23a2317b38453c84324f457b86429e1
-
SSDEEP
1536:SJWnX1QHsrLhSBjCeeiIVrGbbXwTPGGDpqKmY7:SJWnX1QHsrLqjbeXGbbXQgz
Malware Config
Extracted
asyncrat
5.0.5
Venom Clients
127.0.0.1:4449
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
true
-
install_file
microsoft_edge.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000900000001a9ef-10.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 4740 microsoft_edge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 1992 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2992 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 4676 Client.exe 4676 Client.exe 4676 Client.exe 4676 Client.exe 4676 Client.exe 4676 Client.exe 4676 Client.exe 4676 Client.exe 4676 Client.exe 4676 Client.exe 4676 Client.exe 4676 Client.exe 4676 Client.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4676 Client.exe Token: SeDebugPrivilege 4740 microsoft_edge.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4676 wrote to memory of 1508 4676 Client.exe 71 PID 4676 wrote to memory of 1508 4676 Client.exe 71 PID 4676 wrote to memory of 4964 4676 Client.exe 73 PID 4676 wrote to memory of 4964 4676 Client.exe 73 PID 4964 wrote to memory of 1992 4964 cmd.exe 75 PID 4964 wrote to memory of 1992 4964 cmd.exe 75 PID 1508 wrote to memory of 2992 1508 cmd.exe 76 PID 1508 wrote to memory of 2992 1508 cmd.exe 76 PID 4964 wrote to memory of 4740 4964 cmd.exe 77 PID 4964 wrote to memory of 4740 4964 cmd.exe 77 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "microsoft_edge" /tr '"C:\Users\Admin\AppData\Roaming\microsoft_edge.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "microsoft_edge" /tr '"C:\Users\Admin\AppData\Roaming\microsoft_edge.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:2992
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDC46.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1992
-
-
C:\Users\Admin\AppData\Roaming\microsoft_edge.exe"C:\Users\Admin\AppData\Roaming\microsoft_edge.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4656
Network
-
Remote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.179.89.13.in-addr.arpaIN PTRResponse
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
158B
MD5852dd56954547ae87a120aa00beb452b
SHA1f9429ae568e5d3b6afacc1479aaf0fc6006497ce
SHA256ff8e9eed94643972cd33083fd32fb62516fb85b6aeb63bc8d773b0fb8cb1e514
SHA512ecebf87d992c2136a3d11aaed0d21a1586b54b1993aa4f6eac0469426ad2c9149945f5bdc8e55817614b8305e4b73dd460bb947f2061d0a4ea9418b6573d9651
-
Filesize
63KB
MD5730fffd38140c61bade2c837099a4f0d
SHA1615a5bd706eb2676aedaa39fc6927cecef1aae29
SHA256e61f184859c51a4c0213f7481455a711ea45b0c8f8ee241f1e32cb873c10fa28
SHA51251b1a5f9fc240a2174cb7f6e6c2874e875b5045882a5d6e8ce3584a6e343285013be3bf9a6425e0e17f18215ae6fb574a23a2317b38453c84324f457b86429e1