asyncrat | 558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4ca

Analysis

max time kernel
104s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Size

63KB
MD5

64f69ef6324ed1f585cad36cfd40a2d0
SHA1

0f288e78ea422c0507b31cf0288c69b243b61891
SHA256

558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4ca
SHA512

71c32204449f4da5221fc27933c95ae00c9490ccfe54d4e98fe0941008bdcccf039d77a2ad44dc1e2979ac991be2f300c686dcd1ab09c6b285601dc0bcfea68c
SSDEEP

1536:QhB5LrUwk4XO01V5eeiIVrGbbXwdRaGODpqKmY7:QhB5LrUwk4XVVseXGbbXbgz

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

127.0.0.1:4449

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeSecurityPrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeTakeOwnershipPrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeLoadDriverPrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeSystemProfilePrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeSystemtimePrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeProfSingleProcessPrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeIncBasePriorityPrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeCreatePagefilePrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeBackupPrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeRestorePrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeShutdownPrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeDebugPrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeSystemEnvironmentPrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeRemoteShutdownPrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeUndockPrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: SeManageVolumePrivilege	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: 33	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: 34	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: 35	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
Token: 36	1932	558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe

C:\Users\Admin\AppData\Local\Temp\558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe
"C:\Users\Admin\AppData\Local\Temp\558a279c671724e9008afaf7ba73c3f266b2feeb34cd5def64507b72e369c4caN.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-0-0x00007FFA494B3000-0x00007FFA494B5000-memory.dmp

Filesize
8KB

Download
memory/1932-1-0x0000000000D80000-0x0000000000D96000-memory.dmp

Filesize
88KB

Download
memory/1932-2-0x00007FFA494B0000-0x00007FFA49F71000-memory.dmp

Filesize
10.8MB

Download
memory/1932-3-0x00007FFA494B0000-0x00007FFA49F71000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads