asyncrat | ec4289e56bef63ac6d452510494bbe49c791690a9d4fa5109ad013729eb42dd9

Analysis

max time kernel
17s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Venom Rat.exe
Size

55KB
MD5

a244798c97a8a3e37011f53efccd6caa
SHA1

c50d9fe5f809b7ffde015988ec9e603618134b35
SHA256

ec4289e56bef63ac6d452510494bbe49c791690a9d4fa5109ad013729eb42dd9
SHA512

7b17e6e6662e483ca57a3f12b4113795be1e438744de25f09df33ca1bdd60b7e55569db29e2aedc78205d2e16913c66695a09b4f13de73b1567db78b1f3199d2
SSDEEP

1536:ieOPIQIAi28xPShfW1T0NserwffzzkVRnLVclN:/OPIQIIfU1CsNfMbBY

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

147.185.221.21:46268

Mutex

kpujumnfazovbioaqya

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1564-2-0x0000000000EC0000-0x0000000000ED8000-memory.dmp	family_asyncrat

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1332	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1564	Venom Rat.exe
1564	Venom Rat.exe
1564	Venom Rat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	Venom Rat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1564	Venom Rat.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 4776	1564	Venom Rat.exe	93
PID 1564 wrote to memory of 4776	1564	Venom Rat.exe	93
PID 4776 wrote to memory of 1332	4776	cmd.exe	95
PID 4776 wrote to memory of 1332	4776	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\Venom Rat.exe
"C:\Users\Admin\AppData\Local\Temp\Venom Rat.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpACCA.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpACCA.tmp.bat

Filesize
161B

MD5
fa65829dad0bbfa09f73983fa14b19d1

SHA1
b352ea6a5df9030a0454b93e9d054a3f880629a4

SHA256
34741bedfa0c0fbe567640565aa7c0cb8b64210d87919fd0f0998fd66b17b4ff

SHA512
b14a8559408e8b82ce42fffedcab07976fd1e2790fa2f624ecb8c0b3713e2908526d12df6f6fb07e3b07e7a9f5da0c0aafb671002eda52bacd7c38fcd6636bdf

Download Submit
memory/1564-10-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/1564-2-0x0000000000EC0000-0x0000000000ED8000-memory.dmp

Filesize
96KB

Download
memory/1564-4-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/1564-5-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/1564-8-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/1564-0-0x00007FF8B9233000-0x00007FF8B9235000-memory.dmp

Filesize
8KB

Download
memory/1564-11-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/1564-12-0x000000001C620000-0x000000001C696000-memory.dmp

Filesize
472KB

Download
memory/1564-13-0x000000001C5A0000-0x000000001C606000-memory.dmp

Filesize
408KB

Download
memory/1564-14-0x000000001C600000-0x000000001C61E000-memory.dmp

Filesize
120KB

Download
memory/1564-15-0x00007FF8B9233000-0x00007FF8B9235000-memory.dmp

Filesize
8KB

Download
memory/1564-1-0x0000000000600000-0x0000000000614000-memory.dmp

Filesize
80KB

Download
memory/1564-20-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download