asyncrat | b8a841dcd0745845308e7986b1078788a3a799eddbf71e992806d25ab083e669

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-10-2024 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client.exe
Size

74KB
MD5

dd1377928c01ec506f2c2557c5ac04e5
SHA1

f326a125de13bc255e7c43ae2b96e4a3c802753d
SHA256

b8a841dcd0745845308e7986b1078788a3a799eddbf71e992806d25ab083e669
SHA512

e554bf04264ddf878ef3dc54d4aa36c64f048bb12b024ac0e568e644cf251b3646c11239ae41ca844d46c9deb69bc32c3e21a75730d29a849880f61d8e0bf1ae
SSDEEP

1536:8UUPcxVteCW7PMVee9VdQuDI6H1bf/jZEQzcBLVclN:8UmcxV4x7PMVee9VdQsH1bfiQYBY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

127.0.0.1:4449

Mutex

vxtxvcdvzlzd

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

VenomRAT 1 IoCs

Detects VenomRAT.

rat

resource	yara_rule
behavioral1/memory/388-1-0x0000000001320000-0x0000000001338000-memory.dmp	VenomRAT

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	388	Client.exe
Token: SeIncreaseQuotaPrivilege	388	Client.exe
Token: SeSecurityPrivilege	388	Client.exe
Token: SeTakeOwnershipPrivilege	388	Client.exe
Token: SeLoadDriverPrivilege	388	Client.exe
Token: SeSystemProfilePrivilege	388	Client.exe
Token: SeSystemtimePrivilege	388	Client.exe
Token: SeProfSingleProcessPrivilege	388	Client.exe
Token: SeIncBasePriorityPrivilege	388	Client.exe
Token: SeCreatePagefilePrivilege	388	Client.exe
Token: SeBackupPrivilege	388	Client.exe
Token: SeRestorePrivilege	388	Client.exe
Token: SeShutdownPrivilege	388	Client.exe
Token: SeDebugPrivilege	388	Client.exe
Token: SeSystemEnvironmentPrivilege	388	Client.exe
Token: SeRemoteShutdownPrivilege	388	Client.exe
Token: SeUndockPrivilege	388	Client.exe
Token: SeManageVolumePrivilege	388	Client.exe
Token: 33	388	Client.exe
Token: 34	388	Client.exe
Token: 35	388	Client.exe
Token: SeIncreaseQuotaPrivilege	388	Client.exe
Token: SeSecurityPrivilege	388	Client.exe
Token: SeTakeOwnershipPrivilege	388	Client.exe
Token: SeLoadDriverPrivilege	388	Client.exe
Token: SeSystemProfilePrivilege	388	Client.exe
Token: SeSystemtimePrivilege	388	Client.exe
Token: SeProfSingleProcessPrivilege	388	Client.exe
Token: SeIncBasePriorityPrivilege	388	Client.exe
Token: SeCreatePagefilePrivilege	388	Client.exe
Token: SeBackupPrivilege	388	Client.exe
Token: SeRestorePrivilege	388	Client.exe
Token: SeShutdownPrivilege	388	Client.exe
Token: SeDebugPrivilege	388	Client.exe
Token: SeSystemEnvironmentPrivilege	388	Client.exe
Token: SeRemoteShutdownPrivilege	388	Client.exe
Token: SeUndockPrivilege	388	Client.exe
Token: SeManageVolumePrivilege	388	Client.exe
Token: 33	388	Client.exe
Token: 34	388	Client.exe
Token: 35	388	Client.exe

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/388-0-0x000007FEF51C3000-0x000007FEF51C4000-memory.dmp

Filesize
4KB

Download
memory/388-1-0x0000000001320000-0x0000000001338000-memory.dmp

Filesize
96KB

Download
memory/388-3-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

Filesize
9.9MB

Download
memory/388-4-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

Filesize
9.9MB

Download