asyncrat | 46c17ffefbfcaa044cbbcbb33d6219da84538c22a51e53bff647c87da33a0bd9

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 16:14

Target

VenomRAT v6.0.3 (+SOURCE)/VenomRAT v6.0.3 (SOURCE)/Stub/ClientAny.exe
Size

71KB
MD5

958cfc3e7730a66a05d6b8a49ce13d63
SHA1

ebc55f86cccfead463fcc1e6a060a5012fb09907
SHA256

eedce349ce30bae2c269040ac02e0c1d2a979cd2743dc89dc8138e61b30f1798
SHA512

cd6c4f6229a5d97a9b335cbbaf16e4ceab2efde6dd6e17ea0e8645d12739bd2a7ab8e6a77887dd92894af17305df6aafd051c0bfdd8fe7965225f0d538d9fbc5
SSDEEP

768:+MFJ2BAxBMXR5OavIpl2d90CfOmPiEq586H+XVhMZEILH5DMnuqUch04U0VTLgSv:HJmm+g58TXsDpUuqbdLuGjhDeVclN

Score

10^/10

asyncrat rat

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ClientAny.exe

description pid process

Token: SeDebugPrivilege 3532 ClientAny.exe

description	pid	process
Token: SeDebugPrivilege	3532	ClientAny.exe

C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3 (+SOURCE)\VenomRAT v6.0.3 (SOURCE)\Stub\ClientAny.exe
"C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3 (+SOURCE)\VenomRAT v6.0.3 (SOURCE)\Stub\ClientAny.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3532

memory/3532-0-0x00007FFA20193000-0x00007FFA20195000-memory.dmp

Filesize
8KB

Download
memory/3532-1-0x00000000008A0000-0x00000000008B8000-memory.dmp

Filesize
96KB

Download
memory/3532-3-0x00007FFA20190000-0x00007FFA20C51000-memory.dmp

Filesize
10.8MB

Download
memory/3532-4-0x00007FFA20190000-0x00007FFA20C51000-memory.dmp

Filesize
10.8MB

Download