asyncrat | 559578d867c5175177e2f29b2470cad022a6eaddb1197dd8617a11e4b31ddaa4

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

559578d867c5175177e2f29b2470cad022a6eaddb1197dd8617a11e4b31ddaa4.exe
Size

74KB
MD5

af2e76c24f871c53d380d8025145a8c2
SHA1

c8d3f32699b25c9c1ee55b4e15a5fc60eecbb589
SHA256

559578d867c5175177e2f29b2470cad022a6eaddb1197dd8617a11e4b31ddaa4
SHA512

63c2241370954f7862622229deb77842a667c0d57f14b2d601c81a529bf2d0c74d58812e564860272f44bd55d78c513a6db7022c50edfdc030b54fe6c8ef71cd
SSDEEP

1536:6So2ViayysWDbEhuijPsWDbEhuijsAOpQf81dMQqbV4VMrIw90b37hE3HCNZ8zcz:6SLViDpQ0bMx54Vk90b39EXG8/BY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

85.105.15.233:5555

Mutex

cjgfshlnkosvnhlasoq

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

VenomRAT 1 IoCs

Detects VenomRAT.

rat

resource	yara_rule
behavioral1/memory/1400-1-0x0000000000290000-0x00000000002A8000-memory.dmp	VenomRAT

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2832	1400	559578d867c5175177e2f29b2470cad022a6eaddb1197dd8617a11e4b31ddaa4.exe	29
PID 1400 wrote to memory of 2832	1400	559578d867c5175177e2f29b2470cad022a6eaddb1197dd8617a11e4b31ddaa4.exe	29
PID 1400 wrote to memory of 2832	1400	559578d867c5175177e2f29b2470cad022a6eaddb1197dd8617a11e4b31ddaa4.exe	29

C:\Users\Admin\AppData\Local\Temp\559578d867c5175177e2f29b2470cad022a6eaddb1197dd8617a11e4b31ddaa4.exe
"C:\Users\Admin\AppData\Local\Temp\559578d867c5175177e2f29b2470cad022a6eaddb1197dd8617a11e4b31ddaa4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1400 -s 488
  2⤵
  PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-0-0x000007FEF68F3000-0x000007FEF68F4000-memory.dmp

Filesize
4KB

Download
memory/1400-1-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/1400-2-0x000007FEF68F3000-0x000007FEF68F4000-memory.dmp

Filesize
4KB

Download