Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-10-2024 13:10
General
-
Target
meme.exe
-
Size
74KB
-
MD5
8640b5945987e1baa65eebf113691b9a
-
SHA1
18d2b93f62af0233b40d61a89d9febecccd639d9
-
SHA256
ca3cc88d8c0deb99e153ac606045841d01cafc280bc545c770e001f6c0a56835
-
SHA512
3626590c895062602ec5d05baff1b8bfc2560fb42c2fb9ca4e7668ae805f192f81ee5a25593a7209ad7b3020873999bca1a53323c97b5d10f4a2df9cc0dfb7ed
-
SSDEEP
1536:vUFAcxehvCw2PMV11/D5IIH1b8/AJpQzceLVclN:vU6cxe1/2PMVjrXH1b8IJpQ3BY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
88.173.32.153:8081
Mutex
ogjwcholityhqynwcm
Attributes
-
delay
1
-
install
false
-
install_file
meme
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\meme.exe"C:\Users\Admin\AppData\Local\Temp\meme.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB