Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18-08-2024 18:58
General
-
Target
b659225481283fd8bf9db6d7aa0946cc82ffde90aeaed499fe5d364d23bacb63.exe
-
Size
146KB
-
MD5
f1438f6f3bb2762f946b544c21d131e2
-
SHA1
cd1272ce0e03f77895189b799e2769ea5df6226c
-
SHA256
b659225481283fd8bf9db6d7aa0946cc82ffde90aeaed499fe5d364d23bacb63
-
SHA512
05814c9eeedab3395b5da3da998b71e2bd56fa51f67ad9f02a0d9ea3825f377da50a42599f6ef58c68edfc8b443df5644e051949a5ed5a58b95e1c17e1c53806
-
SSDEEP
3072:Zj/awE9a1bt1jL7FfOPfxGCl/cKt2jtbRzuyq:NiwE9sZ8L92pbdB
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
50.18.145.13:14445
Mutex
qkghdcwldgxftyjz
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b659225481283fd8bf9db6d7aa0946cc82ffde90aeaed499fe5d364d23bacb63.exe"C:\Users\Admin\AppData\Local\Temp\b659225481283fd8bf9db6d7aa0946cc82ffde90aeaed499fe5d364d23bacb63.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB