Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
18-08-2024 18:54
General
-
Target
9df5e4f538b7b00f6cb0b9d3d3a80f2ad102f3bd321732c136c38d6abac6870d.exe
-
Size
74KB
-
MD5
0e51f1f2557089f227fd9d5d0a24bbd3
-
SHA1
b3d1647824d40f02ae22e7d242dc2135392ce16a
-
SHA256
9df5e4f538b7b00f6cb0b9d3d3a80f2ad102f3bd321732c136c38d6abac6870d
-
SHA512
84adcbecb07ea3b7d641eca7f7e8153d09d58d2c38a15f92293dca83ef7ab7d445e5a207fface58b24b898aedcd0956a860cb4e67c68c057468ab13e76f4a50e
-
SSDEEP
1536:/UEkcx4VHsC0SPMVtdyievvI0L1bU/bvdiMQzceLVclN:/Uxcx4GfSPMVvyzdL1bUTd/Q3BY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
147.185.221.16:7771
147.185.221.16:10099
Mutex
oaayyazseupjlwcouxd
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9df5e4f538b7b00f6cb0b9d3d3a80f2ad102f3bd321732c136c38d6abac6870d.exe"C:\Users\Admin\AppData\Local\Temp\9df5e4f538b7b00f6cb0b9d3d3a80f2ad102f3bd321732c136c38d6abac6870d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB