Analysis Overview
SHA256
45d177fa58f5866863009793a9266d1778a99a4162a40dd9f7579af8de2f691e
Threat Level: Known bad
The file 45d177fa58f5866863009793a9266d1778a99a4162a40dd9f7579af8de2f691eN.exe was found to be: Known bad.
Malicious Activity Summary
Asyncrat family
VenomRAT
Venomrat family
AsyncRat
Async RAT payload
Downloads MZ/PE file
Executes dropped EXE
Checks computer location settings
Legitimate hosting services abused for malware hosting/C2
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-29 13:35
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-29 13:35
Reported
2024-11-29 13:37
Platform
win7-20240903-en
Max time kernel
15s
Max time network
16s
Command Line
Signatures
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\45d177fa58f5866863009793a9266d1778a99a4162a40dd9f7579af8de2f691eN.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\45d177fa58f5866863009793a9266d1778a99a4162a40dd9f7579af8de2f691eN.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\45d177fa58f5866863009793a9266d1778a99a4162a40dd9f7579af8de2f691eN.exe
"C:\Users\Admin\AppData\Local\Temp\45d177fa58f5866863009793a9266d1778a99a4162a40dd9f7579af8de2f691eN.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.110.133:443 | raw.githubusercontent.com | tcp |
Files
memory/2104-0-0x000000007480E000-0x000000007480F000-memory.dmp
memory/2104-1-0x0000000000A50000-0x0000000000A58000-memory.dmp
memory/2104-2-0x0000000074800000-0x0000000074EEE000-memory.dmp
memory/2104-3-0x000000007480E000-0x000000007480F000-memory.dmp
memory/2104-4-0x0000000074800000-0x0000000074EEE000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-29 13:35
Reported
2024-11-29 13:37
Platform
win10v2004-20241007-en
Max time kernel
120s
Max time network
103s
Command Line
Signatures
AsyncRat
Asyncrat family
VenomRAT
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Venomrat family
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Downloads MZ/PE file
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\45d177fa58f5866863009793a9266d1778a99a4162a40dd9f7579af8de2f691eN.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\mamammiaa.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\45d177fa58f5866863009793a9266d1778a99a4162a40dd9f7579af8de2f691eN.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\45d177fa58f5866863009793a9266d1778a99a4162a40dd9f7579af8de2f691eN.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\mamammiaa.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\mamammiaa.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3396 wrote to memory of 3524 | N/A | C:\Users\Admin\AppData\Local\Temp\45d177fa58f5866863009793a9266d1778a99a4162a40dd9f7579af8de2f691eN.exe | C:\Users\Admin\AppData\Local\mamammiaa.exe |
| PID 3396 wrote to memory of 3524 | N/A | C:\Users\Admin\AppData\Local\Temp\45d177fa58f5866863009793a9266d1778a99a4162a40dd9f7579af8de2f691eN.exe | C:\Users\Admin\AppData\Local\mamammiaa.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\45d177fa58f5866863009793a9266d1778a99a4162a40dd9f7579af8de2f691eN.exe
"C:\Users\Admin\AppData\Local\Temp\45d177fa58f5866863009793a9266d1778a99a4162a40dd9f7579af8de2f691eN.exe"
C:\Users\Admin\AppData\Local\mamammiaa.exe
"C:\Users\Admin\AppData\Local\mamammiaa.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.108.133:443 | raw.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| N/A | 127.0.0.1:2231 | tcp | |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| N/A | 127.0.0.1:2231 | tcp | |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp | |
| N/A | 127.0.0.1:2231 | tcp |
Files
memory/3396-0-0x0000000074D6E000-0x0000000074D6F000-memory.dmp
memory/3396-1-0x0000000000C40000-0x0000000000C48000-memory.dmp
memory/3396-2-0x0000000074D60000-0x0000000075510000-memory.dmp
C:\Users\Admin\AppData\Local\mamammiaa.exe
| MD5 | d418c00d1fe56a2c3f0361c9cb213d7d |
| SHA1 | a3a1f66520d60ab574ce2334338ea9c6ebffdeed |
| SHA256 | 53c9261aeb39d5841a71322eb3e5bc37196f15ba1f36f8896935b339afaf590b |
| SHA512 | 688cb54f7d551f322c4c222d0612fd02a9c3d868a364baab8a12549dbb94dde7d47103f8cd5755b56c825c9f5373c1eb3cda5a3e9c2017846d379912b6dd0068 |
memory/3524-14-0x00007FFD6EA03000-0x00007FFD6EA05000-memory.dmp
memory/3524-15-0x00000000001F0000-0x0000000000208000-memory.dmp
memory/3524-17-0x00007FFD6EA00000-0x00007FFD6F4C1000-memory.dmp
memory/3396-18-0x0000000074D6E000-0x0000000074D6F000-memory.dmp
memory/3396-19-0x0000000074D60000-0x0000000075510000-memory.dmp
memory/3524-20-0x00007FFD6EA03000-0x00007FFD6EA05000-memory.dmp
memory/3524-21-0x00007FFD6EA00000-0x00007FFD6F4C1000-memory.dmp