Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
07/11/2024, 16:18
General
-
Target
be439f8c08cf82402b4f1cfe5a1e90c7ed0f5599585f20261538722e00f916ff.exe
-
Size
65KB
-
MD5
a2a3b852973bf849122ed159d782a4e7
-
SHA1
1f9a8bca10d8204d1286f7f7f6bf3152495cb489
-
SHA256
be439f8c08cf82402b4f1cfe5a1e90c7ed0f5599585f20261538722e00f916ff
-
SHA512
26107f1dd661d2bba2099d2089edbfe801ed47c63d18c021cacb6c1cdfc43f6ee019c596cc9e285491278d3615a4c6ead8c2df5cf5e67d3a0b059f1627e68ff5
-
SSDEEP
1536:PntG0Ag1JfxQ7Cqmhgkz1bbsTxRQxnasas4ppqKmY7:Pn2g/x/qcgw1bbsTgxaU4yz
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
VenomRAT 5.0.3
Botnet
Venom Clients
C2
ghankall40.duckdns.org:8890
Mutex
Venom_RAT_Mutex_Venom_RAT
Attributes
-
delay
0
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\be439f8c08cf82402b4f1cfe5a1e90c7ed0f5599585f20261538722e00f916ff.exe"C:\Users\Admin\AppData\Local\Temp\be439f8c08cf82402b4f1cfe5a1e90c7ed0f5599585f20261538722e00f916ff.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB