Resubmissions
01-11-2024 19:21
241101-x2x7rasncw 1001-11-2024 19:17
241101-xznwaswjej 1001-11-2024 02:08
241101-ckp5latpgs 10Analysis
-
max time kernel
53s -
max time network
39s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
01-11-2024 19:17
General
-
Target
VenomRAT.v6.0.3.+SOURCE.7z
-
Size
73.7MB
-
MD5
29c6c293c6723135cbe7b5d0fc3a3d20
-
SHA1
17219c8998c1afa1bd7061276958e9ed54cbb393
-
SHA256
46c17ffefbfcaa044cbbcbb33d6219da84538c22a51e53bff647c87da33a0bd9
-
SHA512
d6833432820b6eb2828ffd88a3028f3b3b014176db76330ce5c3af5eeb80aac1d9816d81dfdaa11a972e59ed144551d60c1cf4b0568e5cc7dedcb6df033c12e1
-
SSDEEP
1572864:4VI5gzIBQ4OZRbwhtq81vZ8KCNsuYk+8327i8Nd5Sr5:KIeIa4Atotq87BCyuz+BOKe5
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\VenomRAT.v6.0.3.+SOURCE.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\VenomRAT v6.0.3 (+SOURCE)\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\Desktop\VenomRAT v6.0.3 (+SOURCE)\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a1c2a2870001b66db41bcb020bff1c2d
SHA18c54c6a3564c8892aa9baa15573682e64f3659d9
SHA2560aa9e3ab5c88c5761120206eff5c6e35c90288290b3647a942059705ef5b75e5
SHA512b3bf53120203cfaa951f301b532849cb382d2404c9503916bc1ca39925a9a1530b01045f341fc75d47d65130d0187dcbbf4288b9ef46aa81624b59ba7802794b
-
Filesize
838KB
MD5e59c802bbbc1ebc554f3f7b6a3259ee1
SHA1fdb4fa99e15d6519f18f7afe972fb2b128c5caf4
SHA256d13e0c266cb9b98a911bbb87fd94cd9e5125e3bff93bb9b1032271e7507ef2f6
SHA51234aa13fd54fa262405e68c5f915192fe02b9d2c6560f36c5a5c93ec399407b47996e2d4ed88c22286cc6d578a4356353a9540a729684272611350c4665119e73
-
Filesize
5.0MB
MD55c3017ec9073a7a4f3351440c3daaa8a
SHA1ee1f73f8618439fc8a42f38b32760367bd5ce6b5
SHA256e8d4940767c992e14acb77ba1140d5dac56683afe5096e1b08408b0767466e33
SHA5125d98631f754067e659400183134024cc2a4c22ba4a43ddf592791e01eca5cf1530eabcc4ee34beb7507c56dd02a80ba4704db389753a3119657e1d822c68c02a
-
Filesize
291KB
MD5cb877cd3b77a37f8e279fe7dc6b4ba6a
SHA1a03989c1144a57e9088daa40f829a49298135b03
SHA256bc0d40dcdcc9f3e2e7b7071ffb033811bb094cc6a63907c994acd5415b577930
SHA5128dbbbe8606bd36c2efd4f456840c9cb5dd4966097f3a6a0e81104fe4a50695adf558612d74fd31978728455f699f6623e73dfd5e3fcd405e0afceebe83ddd97b
-
Filesize
4.5MB
MD59ec835a4e269f978eeefd7fd8bd5abb0
SHA1e36a07167bd83d713703a84f3c2c2b8f86cd38f5
SHA256e4d60cac9cacde3cab841854b4c5348df89a4e4027b62de09184a3ddbb81a5a0
SHA5122a72b3615215b94d1b7fce3c9ff28042c4c02ec655e3fdc42008217979b65f39fff9cb75a35ac1426a78aa2f8c0c00354369cdb5b5df155efcde8651878de4d9
-
Filesize
20.0MB
MD507adc748684fd33a198f2dc6eea12666
SHA128f62a05673447a3a347aa6a01ae8cd518126956
SHA25650cba5304bf0a620c119a610e73f545fee688462860706785db507110739a093
SHA512893829cb3e1a27e5cbcab9a3b7ef290b1ec74cb21fc46358f2a08a3149d54bd34258046ac47387ad5777d794478230bf2605897e7259ac7a0241dc1272e121ab
-
Filesize
6.5MB
MD58f335dc88eb706a7b50f45a3fd308dee
SHA11bcfb26b7e945fe29f40a1f2ad19c4be4d590edd
SHA2563f31296a5be7c607874f4fd3e66df9d2c460edbc5c4b41ee5ce93534786310ac
SHA5120d42472c287497878a08393b1b39608c0f466520b1ed9aac83fdbd25171941d40d0d0eb1012503894aaac5a5b64db7ea8d280df6d5f7afdd15490d4cee97ea00
-
Filesize
7.7MB
MD59a4fa4e33d64f44451fc4223a5616355
SHA1124caceb4e82537403a4b5e9b21487c369b69559
SHA256fc4e229d2237af90eb1b76205b543098ee958cbc7558d7a6dab41b5210fdaef5
SHA512869b25aa356a957ba361b4fcc1b3aa8363e7bd23a577538f904995ebaebb8a249398e35cf381f5ba06baed95c8dd3e5d6e3aea8efe5ac8e48ca2482c9d549bf9
-
Filesize
3.6MB
MD58478f5aa3de612bd2cf5e9356688d0f3
SHA184103d2abee8976dcaac172bcb9e064dfd06a890
SHA256ae22e7bebe5c4b59363c5980940c64608d1a35c6b5026e0e088605132187c8da
SHA512d0f3cbf8144c733266e05b2513603f5b44bf6fa359bbff86c3d437e022ef1d6451ce7b3f335d116438346aeb3d93bc5a82a6a548a7b1795f72991112abe6750f
-
Filesize
2.0MB
MD545d8d7bd5e30d8b5da44f6a60e331c87
SHA1301d5dc4a8a1141234559df872ce219c1c7efccb
SHA256e6e670bf76dc46e959f74b09d3c6e614b2121975456b00041e32bd7f5001253f
SHA51223b303f287e0b77d221e8cd24cf2933d4976e9b61dfc9bd03c9f365d44988a0a7ce2e81366466dcdff981931099964ebc04293de2de039e0322eed9ac911291b
-
Filesize
16KB
MD506247396be54c6ebb06fd6ca84ee80cc
SHA151fb23ff498a47c0be900ae43a7030f98794eb59
SHA256669e42b6c6e94dc2735f281aa5b33c0d398b91960158ec556e521974b3be5843
SHA51203d93f22aaf1bc0dc4d26b130aa1cb1668c14b854ff84803c8b2cc74625cda44970dd5be1b17865986eabb6966a7d65c226282becfd7963b72b8035990ffc299
-
Filesize
14.2MB
MD53b3a304c6fc7a3a1d9390d7cbff56634
SHA1e8bd5244e6362968f5017680da33f1e90ae63dd7
SHA2567331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58
SHA5127f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5
-
Filesize
1KB
MD565efef16af8b2bb993e24ca1fdb3f3a7
SHA1e205dcc888582eb51d0ee9690d37a7b75138f715
SHA256c40f74c79715de4c5265dffd643d7bd5dda2caa09ca84e620bc78f7d27df51fc
SHA51229581484c44849ccd0ad9bd2c9058fc56f3589019baf4b833a5fc8ceea0e488a357639c92cbaf977f74d5f2d59abb2b8ee7a607cdc67c6c14592b4bd9c3a5215
-
Filesize
2.3MB
MD56d6e172e7965d1250a4a6f8a0513aa9f
SHA1b0fd4f64e837f48682874251c93258ee2cbcad2b
SHA256d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
SHA51235daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
-
Filesize
7.7MB
-
Filesize
128KB
-
Filesize
864KB
-
Filesize
320KB
-
Filesize
2.3MB
-
Filesize
6.6MB
-
Filesize
5.1MB
-
Filesize
3.6MB
-
Filesize
4.5MB
-
Filesize
10.8MB
-
Filesize
2.1MB
-
Filesize
20.0MB
-
Filesize
680KB
-
Filesize
8KB
-
Filesize
14.2MB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
10.8MB