Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-10-2024 13:17

General

  • Target

    eeeeeee.exe

  • Size

    74KB

  • MD5

    0e25636a64d8988a2f2a18a7969626d2

  • SHA1

    524b58b47fd563b37ffc9c363d8c09101cacd2d4

  • SHA256

    8dc4278083a8db73ad2499dcc55a2a5ce44b5bbfe7c2e4776d61597c9634e645

  • SHA512

    248187747727b6875ba1df02547fc2c098c8d90615fcf6626f328ce31d183b9c99f779ccd0d25aaef003b89bdf830715786b46c5a543346316ff1b4608d6a6cd

  • SSDEEP

    1536:3UFAcxehvCw2PMV21ricIMW1bH//giTQzcGLVclN:3U6cxe1/2PMV8ri+W1bH3XTQfBY

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

88.173.32.153:8081

Mutex

ogjwcholityhqynwcm

Attributes
  • delay

    1

  • install

    false

  • install_file

    meme

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • VenomRAT 1 IoCs

    Detects VenomRAT.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eeeeeee.exe
    "C:\Users\Admin\AppData\Local\Temp\eeeeeee.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1152-0-0x000007FEF51C3000-0x000007FEF51C4000-memory.dmp

    Filesize

    4KB

  • memory/1152-1-0x0000000000A00000-0x0000000000A18000-memory.dmp

    Filesize

    96KB

  • memory/1152-3-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

    Filesize

    9.9MB

  • memory/1152-4-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

    Filesize

    9.9MB

  • memory/1152-5-0x000007FEF51C3000-0x000007FEF51C4000-memory.dmp

    Filesize

    4KB

  • memory/1152-6-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

    Filesize

    9.9MB