Analysis
-
max time kernel
1792s -
max time network
1797s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
27-11-2024 22:07
General
-
Target
AWP.GG.exe
-
Size
63KB
-
MD5
090fb6a455841538572f28e65abe87ad
-
SHA1
b33bb39ecdf6216f2eb0490a1e8b0e6f9d051f56
-
SHA256
f2f9488bf82e70695cc3a8e25e64681bcd057ccdf43aa5187a53f05f33f5c9fb
-
SHA512
703e2bbb8819554de3f47eba85d1c3d42ebb6061a61bc5dc4314ad8ba579786b59996df1beaf0e358fb6f6987c1e238e9b2ea91030552558541a57c47cf3fe56
-
SSDEEP
1536:YhIBLTM3Ufc0cMdQc78dgEmxwbbkwYFG+DpqKmY7:YhIBLTM3Ufc6dD7cywbbkFpgz
Malware Config
Extracted
asyncrat
5.0.5
Venom Clients
but-directive.gl.at.ply.gg:9840
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWP.GG.exe"C:\Users\Admin\AppData\Local\Temp\AWP.GG.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5ac1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\WatchStep.3g2"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
140KB
-
Filesize
108KB
-
Filesize
992KB
-
Filesize
68KB
-
Filesize
16.7MB
-
Filesize
2.7MB
-
Filesize
68KB
-
Filesize
208KB
-
Filesize
992KB
-
Filesize
96KB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
2.0MB
-
Filesize
16.7MB
-
Filesize
72KB
-
Filesize
208KB
-
Filesize
496KB
-
Filesize
2.7MB
-
Filesize
144KB
-
Filesize
160KB
-
Filesize
348KB
-
Filesize
68KB
-
Filesize
412KB
-
Filesize
192KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
260KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
132KB
-
Filesize
9.9MB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.9MB