Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-12-2024 14:10
General
-
Target
QML32_Test.exe
-
Size
74KB
-
MD5
d19a6f265293b9a714760f3a4e15a228
-
SHA1
f6c851e1708d8796019332d3f610599b649562f4
-
SHA256
266d1af2cb4893a07df7b3e99b9c63dd997cc1e48f6b721878eedf393a392c52
-
SHA512
055f0a5f0c8f10dde203580be7223c8a087b18413c10994af883dc8de48f91fc233aa221429be1bee91ec0e056089deb73e493c8620da0b6e4dffae33777237a
-
SSDEEP
1536:WUCccx0dxCKg6PMVP4SfSzyIrH1bC/b2OHcQzcyLVclN:WUTcx0f9g6PMVP4SSH1bCh8QjBY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
127.0.0.1:4449
Mutex
hlvrakbhxgipspjpl
Attributes
-
delay
1
-
install
true
-
install_file
eeeehhhhh.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Venomrat family
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\QML32_Test.exe"C:\Users\Admin\AppData\Local\Temp\QML32_Test.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
9.9MB
-
Filesize
9.9MB