asyncrat | cfc7fe4c48a0b43ca0482550c5b8cc4004d583825e25605b2cf2911062d871b0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfc7fe4c48a0b43ca0482550c5b8cc4004d583825e25605b2cf2911062d871b0.exe
Size

74KB
MD5

304ccda9cdfcd04a4da4dcd3b8359824
SHA1

15f57b369bb27ce09925e4ac7eeccdd1230556d6
SHA256

cfc7fe4c48a0b43ca0482550c5b8cc4004d583825e25605b2cf2911062d871b0
SHA512

9e571a613dceae1c977d26c481ce6f7a9ff700f9aa748474ada86d17d8ad27ebf1ea11a885977943c9915e31fabba278b428b0b34b217315a0c9c2de9eea42b0
SSDEEP

1536:DSi2V95qsWDbEhuijwsWDbEhuijsAOKrn8n/mywr+Gk3m6VLIni0btuhaqAqy8zg:DSpVzhr8eDrxbNi0btwHy8fBY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

147.185.221.19:51216

Mutex

rofolmihxumlsy

Attributes

delay
1
install
true
install_file
666.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

VenomRAT 1 IoCs

Detects VenomRAT.

rat

resource	yara_rule
behavioral1/memory/2384-1-0x0000000000F90000-0x0000000000FA8000-memory.dmp	VenomRAT

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2120	2384	cfc7fe4c48a0b43ca0482550c5b8cc4004d583825e25605b2cf2911062d871b0.exe	30
PID 2384 wrote to memory of 2120	2384	cfc7fe4c48a0b43ca0482550c5b8cc4004d583825e25605b2cf2911062d871b0.exe	30
PID 2384 wrote to memory of 2120	2384	cfc7fe4c48a0b43ca0482550c5b8cc4004d583825e25605b2cf2911062d871b0.exe	30

C:\Users\Admin\AppData\Local\Temp\cfc7fe4c48a0b43ca0482550c5b8cc4004d583825e25605b2cf2911062d871b0.exe
"C:\Users\Admin\AppData\Local\Temp\cfc7fe4c48a0b43ca0482550c5b8cc4004d583825e25605b2cf2911062d871b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2384 -s 488
  2⤵
  PID:2120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-0-0x000007FEF50A3000-0x000007FEF50A4000-memory.dmp

Filesize
4KB

Download
memory/2384-1-0x0000000000F90000-0x0000000000FA8000-memory.dmp

Filesize
96KB

Download
memory/2384-2-0x000007FEF50A3000-0x000007FEF50A4000-memory.dmp

Filesize
4KB

Download