Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
18-08-2024 19:07
General
-
Target
f03e941d050826b288bf5bfb36def419d4e89bba8976ead214db405585af5308.exe
-
Size
73KB
-
MD5
f74e8a071b955f39231c4c209e30f1a3
-
SHA1
594998b0b11979ce447911a3c35e3e93ae7ca26d
-
SHA256
f03e941d050826b288bf5bfb36def419d4e89bba8976ead214db405585af5308
-
SHA512
2bba73f8e75b2c1d37d885a727fca8c6afc70bbb7ad8ba33657fc351760bdc9fabbe0e9e72d7571a7696bed6557371aa3c8f4bdb606f3c0078c047ce866b838a
-
SSDEEP
1536:LUkPcxVteCW7PMVee9VdQkhDIyH1bf/06sDNQzc33VclN:LU2cxV4x7PMVee9VdQgH1bfRsRQylY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
VFPower-[RAT-HVNC]
Botnet
Default
C2
110.42.248.7:4449
Mutex
mzmycyinygwybeaeb
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f03e941d050826b288bf5bfb36def419d4e89bba8976ead214db405585af5308.exe"C:\Users\Admin\AppData\Local\Temp\f03e941d050826b288bf5bfb36def419d4e89bba8976ead214db405585af5308.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.9MB