asyncrat | d1be1638433de6b9fee0d915a719d69f639ba6cadb0a31e9eaea034ebd562b12

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-10-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hello.exe
Size

74KB
MD5

74157d6bda58b1d9c8690a3a5c11dda1
SHA1

c8d43e462620b65c1452bcc45f63eeedb51d0d56
SHA256

d1be1638433de6b9fee0d915a719d69f639ba6cadb0a31e9eaea034ebd562b12
SHA512

ead09464c5bdbfdc2702413c58bd17efcc35e15f068dcfcf55c905c003711b524997ffdd6e089999f6be724f9a5f5185e8c026ce1bb3f4a632024b9955230e38
SSDEEP

1536:gUUPcxVteCW7PMV+Ydj/yLEgItH1bc/ThQzcyLVclN:gUmcxV4x7PMVF/nTH1bcNQjBY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

127.0.0.1:4449

Mutex

whbdpkgbrimkqqf

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

VenomRAT 1 IoCs

Detects VenomRAT.

rat

resource	yara_rule
behavioral1/memory/2000-1-0x00000000002A0000-0x00000000002B8000-memory.dmp	VenomRAT

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	hello.exe
Token: SeIncreaseQuotaPrivilege	2000	hello.exe
Token: SeSecurityPrivilege	2000	hello.exe
Token: SeTakeOwnershipPrivilege	2000	hello.exe
Token: SeLoadDriverPrivilege	2000	hello.exe
Token: SeSystemProfilePrivilege	2000	hello.exe
Token: SeSystemtimePrivilege	2000	hello.exe
Token: SeProfSingleProcessPrivilege	2000	hello.exe
Token: SeIncBasePriorityPrivilege	2000	hello.exe
Token: SeCreatePagefilePrivilege	2000	hello.exe
Token: SeBackupPrivilege	2000	hello.exe
Token: SeRestorePrivilege	2000	hello.exe
Token: SeShutdownPrivilege	2000	hello.exe
Token: SeDebugPrivilege	2000	hello.exe
Token: SeSystemEnvironmentPrivilege	2000	hello.exe
Token: SeRemoteShutdownPrivilege	2000	hello.exe
Token: SeUndockPrivilege	2000	hello.exe
Token: SeManageVolumePrivilege	2000	hello.exe
Token: 33	2000	hello.exe
Token: 34	2000	hello.exe
Token: 35	2000	hello.exe
Token: SeIncreaseQuotaPrivilege	2000	hello.exe
Token: SeSecurityPrivilege	2000	hello.exe
Token: SeTakeOwnershipPrivilege	2000	hello.exe
Token: SeLoadDriverPrivilege	2000	hello.exe
Token: SeSystemProfilePrivilege	2000	hello.exe
Token: SeSystemtimePrivilege	2000	hello.exe
Token: SeProfSingleProcessPrivilege	2000	hello.exe
Token: SeIncBasePriorityPrivilege	2000	hello.exe
Token: SeCreatePagefilePrivilege	2000	hello.exe
Token: SeBackupPrivilege	2000	hello.exe
Token: SeRestorePrivilege	2000	hello.exe
Token: SeShutdownPrivilege	2000	hello.exe
Token: SeDebugPrivilege	2000	hello.exe
Token: SeSystemEnvironmentPrivilege	2000	hello.exe
Token: SeRemoteShutdownPrivilege	2000	hello.exe
Token: SeUndockPrivilege	2000	hello.exe
Token: SeManageVolumePrivilege	2000	hello.exe
Token: 33	2000	hello.exe
Token: 34	2000	hello.exe
Token: 35	2000	hello.exe

C:\Users\Admin\AppData\Local\Temp\hello.exe
"C:\Users\Admin\AppData\Local\Temp\hello.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-0-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

Filesize
4KB

Download
memory/2000-1-0x00000000002A0000-0x00000000002B8000-memory.dmp

Filesize
96KB

Download
memory/2000-3-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/2000-4-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download