asyncrat | 6f33ae4bf134c49faa14517a275c039ca1818b24fc2304649869e399ab2fb389

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-10-2024 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Coffee.exe
Size

63KB
MD5

961d8e0f1ec3c196499bfcbd0a9d19fa
SHA1

88b7f13c633260a463127ce2ba6fbe38137e856a
SHA256

cd903ad2211cf7d166646d75e57fb866000f4a3b870b5ec759929be2fd81d334
SHA512

53ee498a9a4e458d072bfd50c86b2f89b7f56f723e66fadde223f6ccff0c6871ccb41a9886b4b98812f53111f9e9fe4ca10aa3633d54afca923833b12dbcd66b
SSDEEP

1536:OhIBLTM3Ufc0cMdmeeiIVrGbbXwemZG5dpqKmY7:OhIBLTM3Ufc6d/eXGbbXLmiGz

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

127.0.0.1:3451

37.120.233.226:3451

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	Coffee.exe
Token: SeDebugPrivilege	2812	taskmgr.exe
Token: SeDebugPrivilege	2572	Coffee.exe
Token: SeDebugPrivilege	3040	Coffee.exe
Token: SeDebugPrivilege	2364	Coffee.exe
Token: SeDebugPrivilege	1424	Coffee.exe
Token: SeDebugPrivilege	2888	Coffee.exe
Token: SeDebugPrivilege	2904	Coffee.exe
Token: SeDebugPrivilege	3008	Coffee.exe
Token: SeDebugPrivilege	1276	Coffee.exe
Token: SeDebugPrivilege	2656	Coffee.exe
Token: SeDebugPrivilege	1508	Coffee.exe
Token: SeDebugPrivilege	1196	Coffee.exe
Token: SeDebugPrivilege	760	Coffee.exe
Token: SeDebugPrivilege	596	Coffee.exe
Token: SeDebugPrivilege	528	Coffee.exe
Token: SeDebugPrivilege	2852	Coffee.exe
Token: SeDebugPrivilege	1568	Coffee.exe
Token: SeDebugPrivilege	2964	Coffee.exe
Token: SeDebugPrivilege	1296	Coffee.exe
Token: SeDebugPrivilege	1920	Coffee.exe
Token: SeDebugPrivilege	2536	Coffee.exe
Token: SeDebugPrivilege	520	Coffee.exe
Token: SeDebugPrivilege	840	Coffee.exe
Token: SeDebugPrivilege	1972	Coffee.exe
Token: SeDebugPrivilege	2984	Coffee.exe
Token: SeDebugPrivilege	2180	Coffee.exe
Token: SeDebugPrivilege	1860	Coffee.exe
Token: SeDebugPrivilege	2516	Coffee.exe
Token: SeDebugPrivilege	884	Coffee.exe
Token: SeDebugPrivilege	3004	Coffee.exe
Token: SeDebugPrivilege	1548	Coffee.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2812

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3040

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2904

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:760

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:596

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:528

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:520

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:884

C:\Users\Admin\AppData\Local\Temp\Coffee.exe
"C:\Users\Admin\AppData\Local\Temp\Coffee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2248-0-0x000007FEF5173000-0x000007FEF5174000-memory.dmp

Filesize
4KB

Download
memory/2248-1-0x0000000000A70000-0x0000000000A86000-memory.dmp

Filesize
88KB

Download
memory/2248-2-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Filesize
9.9MB

Download
memory/2248-3-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Filesize
9.9MB

Download
memory/2248-6-0x000007FEF5173000-0x000007FEF5174000-memory.dmp

Filesize
4KB

Download
memory/2248-7-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Filesize
9.9MB

Download
memory/2248-8-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Filesize
9.9MB

Download
memory/2812-4-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2812-5-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2812-9-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2812-10-0x0000000001F70000-0x0000000001F80000-memory.dmp

Filesize
64KB

Download