Analysis
-
max time kernel
138s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
18-08-2024 18:53
General
-
Target
96c71b643c6005bc358df3aa5e676369d3d8f662954c28207e11fcb42358a1a3.exe
-
Size
214KB
-
MD5
5334c1d47679ad80a323fd31426e7dda
-
SHA1
edebb69011e5efc4d13362159bf8cc5984f05dca
-
SHA256
96c71b643c6005bc358df3aa5e676369d3d8f662954c28207e11fcb42358a1a3
-
SHA512
3503affd35b79cd6f40c27eb8abebc3366731edc3c9b03a2df17989f6bb8f8b7f5762a1076862c709f43d48ab19ad37c61ce1005283d7c43a75423759a893f25
-
SSDEEP
3072:tUxcx4GfSPMVla37EH1bysbh8jQ6KramZ4sj+9Uz+HBnltdbh77xmnkqnnkwY:t5fSPMVllVbhhYY5TjWUzoll7k9
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
193.161.193.99:44454
Mutex
jjpfhegnfbtftrtcbyw
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96c71b643c6005bc358df3aa5e676369d3d8f662954c28207e11fcb42358a1a3.exe"C:\Users\Admin\AppData\Local\Temp\96c71b643c6005bc358df3aa5e676369d3d8f662954c28207e11fcb42358a1a3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB