Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
02-12-2024 00:51
General
-
Target
sigmamama.exe
-
Size
74KB
-
MD5
8eef8648102950bb5d3161de5042123b
-
SHA1
39884794414c095d98d772c585bda257511d1aa0
-
SHA256
79e4a5d0dbd91fb09ad71062059c8712600ba713fe39b81f44c3a027df2edd66
-
SHA512
8797d3e3f20cfb71f64e75ca26127de50dbf4bb432d9010fb134223acecd9c7aa3d696e8d23d197ebbbde581fc5039473ee25ac3116db5c32c2a9777650ef85e
-
SSDEEP
1536:4RU98cxpeaC/zPMVKCyeFIFA1bd/eaXQzcOLVclN:uU+cxp7AzPMVx2A1bdGaXQHBY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
127.0.0.1:4449
Mutex
lvqvmuzfdbs
Attributes
-
delay
1
-
install
true
-
install_file
ehhhh.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Venomrat family
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sigmamama.exe"C:\Users\Admin\AppData\Local\Temp\sigmamama.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
9.9MB
-
Filesize
9.9MB