Analysis
-
max time kernel
148s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09-08-2024 12:46
General
-
Target
Client.exe
-
Size
74KB
-
MD5
8a5bda75f0d59b146b6ca58caaab7da5
-
SHA1
16d970a2b269fedb6fa7d9c198b07156ab111410
-
SHA256
a8b721d8750569c66772c1cde825c4a521e06438275ac4332ad6357223c11e68
-
SHA512
c0b4d3c58f425b86847c703b9a404153372739db20006767d0ca976de1b2c9e61d1a0b874406d3c550bdad487b8a3b805eab08e0656b2f723a97e810aa5c35d4
-
SSDEEP
1536:8UUPcxVteCW7PMVee9VdQuDI6H1bf/+HIQzcBLVclN:8UmcxV4x7PMVee9VdQsH1bftQYBY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
127.0.0.1:4449
127.0.0.1:6969
Mutex
fbrjfgddfoqbhlz
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB