Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-12-2024 00:59
General
-
Target
rizzlerohio.exe
-
Size
74KB
-
MD5
9701d309065d5aad69976a510447afba
-
SHA1
7d8dd14b178c48eb2c2acd8b0b182d2e2f639742
-
SHA256
3641780a2c6684dd78756f48eeaa9b24c068885ac7390eadad7d0f030152f222
-
SHA512
69e7a08afeb727efd182f2aab1a3ef181034ce1c652bd6ac13e31940119220ed20d80166cbb050d20dc9523a73f8e4252003b5fab119b00798f05a63bada3564
-
SSDEEP
1536:sRU98cxpeaC/zPMVnJv7j41wI9H1bH/kQzcSLVclN:yU+cxp7AzPMVnJv7j4JH1bH8QDBY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
147.185.221.241:4449
Mutex
xjuqkosgzx
Attributes
-
delay
1
-
install
true
-
install_file
ehhhh.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Venomrat family
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rizzlerohio.exe"C:\Users\Admin\AppData\Local\Temp\rizzlerohio.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
10.8MB