Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
28-11-2024 09:33
General
-
Target
1f06ff3d8f50e6c184beca758aaad63936ad20a056b8ae4c8138d85ccc703a46.exe
-
Size
74KB
-
MD5
4b1b45bb55ccdd4b078459ade3763e6d
-
SHA1
049344853c902e22e70ae231c669bf0751185716
-
SHA256
1f06ff3d8f50e6c184beca758aaad63936ad20a056b8ae4c8138d85ccc703a46
-
SHA512
b95739746df825e83e59b81f11f841d6029f92bebcd46485df456b23ff1c87cbce097d1e695a9f0a2559bcd9960a4f4fc137bca95233fafe95b13ddf5fabad65
-
SSDEEP
1536:gUUPcxVteCW7PMV922zONi6I+H1bP/GQzcyLVclN:gUmcxV4x7PMV922zONNH1bPuQjBY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
3.70.228.168:555
Mutex
wzchqtvtkfun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f06ff3d8f50e6c184beca758aaad63936ad20a056b8ae4c8138d85ccc703a46.exe"C:\Users\Admin\AppData\Local\Temp\1f06ff3d8f50e6c184beca758aaad63936ad20a056b8ae4c8138d85ccc703a46.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB