asyncrat | 46c17ffefbfcaa044cbbcbb33d6219da84538c22a51e53bff647c87da33a0bd9

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 16:14

Target

VenomRAT v6.0.3 (+SOURCE)/VenomRAT v6.0.3 (SOURCE)/Stub/ClientAny.exe
Size

71KB
MD5

958cfc3e7730a66a05d6b8a49ce13d63
SHA1

ebc55f86cccfead463fcc1e6a060a5012fb09907
SHA256

eedce349ce30bae2c269040ac02e0c1d2a979cd2743dc89dc8138e61b30f1798
SHA512

cd6c4f6229a5d97a9b335cbbaf16e4ceab2efde6dd6e17ea0e8645d12739bd2a7ab8e6a77887dd92894af17305df6aafd051c0bfdd8fe7965225f0d538d9fbc5
SSDEEP

768:+MFJ2BAxBMXR5OavIpl2d90CfOmPiEq586H+XVhMZEILH5DMnuqUch04U0VTLgSv:HJmm+g58TXsDpUuqbdLuGjhDeVclN

Score

10^/10

asyncrat rat

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ClientAny.exe

description pid process

Token: SeDebugPrivilege 2736 ClientAny.exe

description	pid	process
Token: SeDebugPrivilege	2736	ClientAny.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ClientAny.exe

description	pid	process	target process
PID 2736 wrote to memory of 2824	2736	ClientAny.exe	WerFault.exe
PID 2736 wrote to memory of 2824	2736	ClientAny.exe	WerFault.exe
PID 2736 wrote to memory of 2824	2736	ClientAny.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3 (+SOURCE)\VenomRAT v6.0.3 (SOURCE)\Stub\ClientAny.exe
"C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3 (+SOURCE)\VenomRAT v6.0.3 (SOURCE)\Stub\ClientAny.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2736 -s 600
  2⤵
  PID:2824

memory/2736-0-0x000007FEF5D13000-0x000007FEF5D14000-memory.dmp

Filesize
4KB

Download
memory/2736-1-0x0000000000EC0000-0x0000000000ED8000-memory.dmp

Filesize
96KB

Download
memory/2736-3-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/2736-4-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download