Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
18-08-2024 18:56
General
-
Target
ad33c4b3814f7db554bf92897d3e2be54697082567f9afa60707f3f67a9492e7.exe
-
Size
83KB
-
MD5
b1acbd3e8ecec9575b91b96402a84dd2
-
SHA1
5e717fa879da36f1610a0bd874c2e153f0ec78d9
-
SHA256
ad33c4b3814f7db554bf92897d3e2be54697082567f9afa60707f3f67a9492e7
-
SHA512
a3a4d893ccda651afe9b99aac661a7d76976cdbbd6bbc928996288763b4d479df6dfedcb72efd2247c36bf6f987b7951759dee59381258bbe2de53620b50da40
-
SSDEEP
1536:LUEkcx4VHsC0SPMVKUiLsiIynH1bo/wIQzcrLVclN:LUxcx4GfSPMVFiFnH1boFQSBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
95.142.46.3:4449
95.142.46.3:7000
zlgcqgmshzbvhurfz
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad33c4b3814f7db554bf92897d3e2be54697082567f9afa60707f3f67a9492e7.exe"C:\Users\Admin\AppData\Local\Temp\ad33c4b3814f7db554bf92897d3e2be54697082567f9afa60707f3f67a9492e7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
9.4MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB