Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
18-08-2024 18:58
General
-
Target
ba8547e96b9046215ec49a0a645292796318e539fdfe52b1c1f39f9960114ed5.exe
-
Size
104KB
-
MD5
a619d978d3c0d9e5af0596c4bb4070f1
-
SHA1
6354d3920979c0d075f685b7d2cf869f60b45cf7
-
SHA256
ba8547e96b9046215ec49a0a645292796318e539fdfe52b1c1f39f9960114ed5
-
SHA512
e2819c30e08d23246ac01b188e8f34547fb0291833d2692bd1917b211b936e46d2be1d85fb73fabc8ec5240e081767538804c3b93a3aa0a443b36570c4678f87
-
SSDEEP
3072:QURcxVMWiPMVye9VdQsH1bfDFuBQAjZqMN7iY:QwWiPMVyaesVbMBrvG
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
Mutex
pwsbendzcg
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/5jPfwjnH
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba8547e96b9046215ec49a0a645292796318e539fdfe52b1c1f39f9960114ed5.exe"C:\Users\Admin\AppData\Local\Temp\ba8547e96b9046215ec49a0a645292796318e539fdfe52b1c1f39f9960114ed5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB