Analysis
-
max time kernel
139s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-12-2024 15:29
General
-
Target
e858ea725e2aaeb800365849a45248626e53eebf366f30e2ad34705680d14309.exe
-
Size
74KB
-
MD5
3c283797e169a004438e466cc682926c
-
SHA1
31d2d07264d13a4b8c9405246ac8e09ecf04e810
-
SHA256
e858ea725e2aaeb800365849a45248626e53eebf366f30e2ad34705680d14309
-
SHA512
84303dbfe5a0133d67059dbdfd8f6c2b62fb30a0100e082b985e37403bc9d5236b10a76a180f2675f36a748757b388829675709c297bcc5b97d12ed728522a11
-
SSDEEP
1536:jUk0cxVGlCBiPMVWleiUIt/1b8/+KFDQzcmLVclN:jURcxVMWiPMVseiv/1b8TxQ/BY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
Mutex
sikegozvdjqrc
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.ai/raw/njrtyvo7ig
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Venomrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e858ea725e2aaeb800365849a45248626e53eebf366f30e2ad34705680d14309.exe"C:\Users\Admin\AppData\Local\Temp\e858ea725e2aaeb800365849a45248626e53eebf366f30e2ad34705680d14309.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB