Analysis
-
max time kernel
130s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
18-08-2024 18:51
General
-
Target
7fc43d4a1eb45e4330c76eaf695d2ad2078d9e12bdf1628f68141e028b42dd1e.exe
-
Size
77KB
-
MD5
1625971b818bd299f2d9371314e73bd7
-
SHA1
8989f453764d8e2c53aa54551e3d1b93b47cf729
-
SHA256
7fc43d4a1eb45e4330c76eaf695d2ad2078d9e12bdf1628f68141e028b42dd1e
-
SHA512
3c95f0218b592674f3fe3a82d639ab03dfc8586bb6e4a3e7746cf3a97583aa5b33e8947a4288f1c165c6eb6b8329ccf9f40b754189306eaa4e36ef0ac43a8131
-
SSDEEP
1536:xUXkcxVKpC6yPMVKe9VdQuDI6H1bf/eAn9781dwQzcv7IVclN:xU0cxVENyPMVKe9VdQsH1bffne1mQu7F
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
127.0.0.1:1900
127.0.0.1:5353
192.168.111.128:1900
192.168.111.128:5353
192.168.138.1:1900
192.168.138.1:5353
twstgusmrfstyqherse
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fc43d4a1eb45e4330c76eaf695d2ad2078d9e12bdf1628f68141e028b42dd1e.exe"C:\Users\Admin\AppData\Local\Temp\7fc43d4a1eb45e4330c76eaf695d2ad2078d9e12bdf1628f68141e028b42dd1e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB