Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01/12/2024, 21:34
General
-
Target
Rizz.exe
-
Size
74KB
-
MD5
df7d5afd270dc1c1c8cb3deab2b76a8a
-
SHA1
7145ce99adca67a8de2c8d50369a1567adc8885a
-
SHA256
557444bf67a947a6c98822d3c6826b01a22297e19d90effb7383e3201e05e12d
-
SHA512
106d3629f74bb47fe152779d7edefc859b673cdbe30ab931763b09723d80b676c573af7a8719f6cfe704ccbfd4a43faaf71ff1be87b1a6df37c34cf0ee188efe
-
SSDEEP
1536:cRU98cxpeaC/zPMVrj/dzItH1bV/Oh/QzciLVclN:CU+cxp7AzPMVrj2H1bVy/QzBY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
192.168.0.122:1234
Mutex
wadikaaikdd
Attributes
-
delay
1
-
install
true
-
install_file
Sigma.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rizz.exe"C:\Users\Admin\AppData\Local\Temp\Rizz.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
9.9MB
-
Filesize
9.9MB