asyncrat | 46c17ffefbfcaa044cbbcbb33d6219da84538c22a51e53bff647c87da33a0bd9

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 16:14

Target

VenomRAT v6.0.3 (+SOURCE)/VenomRAT v6.0.3 (SOURCE)/Stub/Clientx64.exe
Size

71KB
MD5

33aa30124ec0b36f1a9319cd62a11e84
SHA1

f8181335be708048b28cf1540054a5dd9d6acf8c
SHA256

c6a8838b3619db76fc89af6bbd9188f868557348b3d06e2815eae2882dae8ec3
SHA512

fceed2946791b47eb3e9f5b94fb11104abdc6bd8c2ae3c4c4694880af168608822a0b77ceecaeda125a04ffe2fcc081bf0e003c17ba3dc34a6ad261d45da7e65
SSDEEP

768:aEFJ2BAxBMXR5OavIpl2d90CfOmfiEq586H+XVhMxEILH5DMnuqLch04U0VTLgSS:LJmm+A58TXsLpUuqudLuGjhMCVclN

Score

10^/10

asyncrat rat

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Clientx64.exe

description pid process

Token: SeDebugPrivilege 1716 Clientx64.exe

description	pid	process
Token: SeDebugPrivilege	1716	Clientx64.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Clientx64.exe

description	pid	process	target process
PID 1716 wrote to memory of 1272	1716	Clientx64.exe	WerFault.exe
PID 1716 wrote to memory of 1272	1716	Clientx64.exe	WerFault.exe
PID 1716 wrote to memory of 1272	1716	Clientx64.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3 (+SOURCE)\VenomRAT v6.0.3 (SOURCE)\Stub\Clientx64.exe
"C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3 (+SOURCE)\VenomRAT v6.0.3 (SOURCE)\Stub\Clientx64.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1716 -s 600
  2⤵
  PID:1272

memory/1716-0-0x000007FEF5083000-0x000007FEF5084000-memory.dmp

Filesize
4KB

Download
memory/1716-1-0x0000000000B70000-0x0000000000B88000-memory.dmp

Filesize
96KB

Download
memory/1716-3-0x000007FEF5080000-0x000007FEF5A6C000-memory.dmp

Filesize
9.9MB

Download
memory/1716-4-0x000007FEF5080000-0x000007FEF5A6C000-memory.dmp

Filesize
9.9MB

Download