Analysis

  • max time kernel
    115s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2024 10:20

General

  • Target

    bdb7a3283cbf0d20271acacbb1aea2f94018b4e477049c706be3cf66cc3239f5N.exe

  • Size

    571KB

  • MD5

    fa5c1bd700ac8b0b4035f607c6ee7ea0

  • SHA1

    beba6ca16333e1480d201150ef2f02fbd1e4b613

  • SHA256

    bdb7a3283cbf0d20271acacbb1aea2f94018b4e477049c706be3cf66cc3239f5

  • SHA512

    715def92ccc0f54a20428073fdaad05eeea1136e190fb16f9c53f9b0bf504b3eeeda4c6435c922239f40e80b989474ba80cc76f048ff553a360ec75fe81860ef

  • SSDEEP

    12288:Fw6EjbSan4SRRRtK9mFuj0FaUua1AVsqTTCJVMf:xEjbESRbtK94u4uYARXCJVi

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Night -job

C2

62.210.189.1:4449

163.172.121.118:4449

Mutex

system-verison-window protection

Attributes
  • delay

    0

  • install

    true

  • install_file

    system.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • VenomRAT 1 IoCs

    Detects VenomRAT.

  • Venomrat family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bdb7a3283cbf0d20271acacbb1aea2f94018b4e477049c706be3cf66cc3239f5N.exe
    "C:\Users\Admin\AppData\Local\Temp\bdb7a3283cbf0d20271acacbb1aea2f94018b4e477049c706be3cf66cc3239f5N.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\bdb7a3283cbf0d20271acacbb1aea2f94018b4e477049c706be3cf66cc3239f5N.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:976
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fSweJFqnYqBidH.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3388
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fSweJFqnYqBidH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF9F0.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:1612
    • C:\Users\Admin\AppData\Local\Temp\bdb7a3283cbf0d20271acacbb1aea2f94018b4e477049c706be3cf66cc3239f5N.exe
      "C:\Users\Admin\AppData\Local\Temp\bdb7a3283cbf0d20271acacbb1aea2f94018b4e477049c706be3cf66cc3239f5N.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "system" /tr '"C:\Users\Admin\AppData\Roaming\system.exe"' & exit
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1796
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "system" /tr '"C:\Users\Admin\AppData\Roaming\system.exe"'
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2812
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4CD.tmp.bat""
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2768
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          4⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:3860
        • C:\Users\Admin\AppData\Roaming\system.exe
          "C:\Users\Admin\AppData\Roaming\system.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4288
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\system.exe"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:392
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fSweJFqnYqBidH.exe"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1732
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fSweJFqnYqBidH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6EC2.tmp"
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:4864
          • C:\Users\Admin\AppData\Roaming\system.exe
            "C:\Users\Admin\AppData\Roaming\system.exe"
            5⤵
            • Executes dropped EXE
            PID:2948
          • C:\Users\Admin\AppData\Roaming\system.exe
            "C:\Users\Admin\AppData\Roaming\system.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:864

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bdb7a3283cbf0d20271acacbb1aea2f94018b4e477049c706be3cf66cc3239f5N.exe.log

    Filesize

    1KB

    MD5

    7ef67a0a2b1e31df887adcdaf86e4bbd

    SHA1

    348aad52be33f1a0c477e2ace332ecf91bb0e1a8

    SHA256

    af207d70281cc3264107da297e00ab97d0af2f055d6065ca5936cf69db6d783f

    SHA512

    4ffab7944ec049f2597bda791de5fd3ae3578b03ef019d2222850b8f5a298e3aae8b6e33f71c38e47132d63fb58ab1b03c876b9a01665bc8bbcf01466e7d79e1

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    5799755446ba3e18d38d6641551c18b3

    SHA1

    4ca28173e268a2b8c4323f7c473b33c8d0bc92e3

    SHA256

    3365d3c00a4bbbbc667cd3989c0e098b199b1ad1b04f71d104b754d5f4aaa4a4

    SHA512

    15e267f6f51888361e6c4eb4cc9834509633d9c5bb2beb2ccb3a760287fc669eaa0d3c58668c8385fdbcb0797881cb39868c94777a7e97bc242ec6b45702865e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    b949b4844eabcc15d953c4a34d3acefd

    SHA1

    cf6362a067a17bac5d8f01ab685ae9b6046c39d1

    SHA256

    bf3a2a6f8c8afa99366376cdb7bec3a50aa510843f78eaa50b7d03d1788692a0

    SHA512

    3595ee83d643fd0159176a3ec2871540b47c78af13e9ad6f530abfbe7b237d99cd97857764afd7140a81979dca5a4a7f8ef885f594db9de2bc8a0a1d939c91b9

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1rqkt5vm.ovq.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmp4CD.tmp.bat

    Filesize

    149B

    MD5

    91ea3375a03118111efce53accb7cdae

    SHA1

    45dd2943df44ca641268068fcfb0952dab8ec26d

    SHA256

    6322120e00d54b40ae3532ee0121d3b164e26220f6ac9b4d7bfd68df918746f6

    SHA512

    5e18dd87241318d4cd62d99712ee093ef5691138707b5c6e4e14d9ad5c1156690b34448391dd2d0347666831625841e636612d2ba28d4589ed66558498816492

  • C:\Users\Admin\AppData\Local\Temp\tmpF9F0.tmp

    Filesize

    1KB

    MD5

    9113276415eabea7df4f3246f5bde43d

    SHA1

    b29e34d0be9a5ed991ea62b522ad7a78f216647a

    SHA256

    92a219561292ba8e883d0ec5727a00d9b895ec733d695641c2d7e5c28d3ec0e2

    SHA512

    f3814be02b3c3be3c1f02fb15eeac5bb54cd765220efe4b007e73488276bfb397ab64820c07fc04c9f745d9faf5cca57d43e7d646e5b10addb7f6fe5c0394e38

  • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

    Filesize

    8B

    MD5

    cf759e4c5f14fe3eec41b87ed756cea8

    SHA1

    c27c796bb3c2fac929359563676f4ba1ffada1f5

    SHA256

    c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

    SHA512

    c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

  • C:\Users\Admin\AppData\Roaming\system.exe

    Filesize

    571KB

    MD5

    fa5c1bd700ac8b0b4035f607c6ee7ea0

    SHA1

    beba6ca16333e1480d201150ef2f02fbd1e4b613

    SHA256

    bdb7a3283cbf0d20271acacbb1aea2f94018b4e477049c706be3cf66cc3239f5

    SHA512

    715def92ccc0f54a20428073fdaad05eeea1136e190fb16f9c53f9b0bf504b3eeeda4c6435c922239f40e80b989474ba80cc76f048ff553a360ec75fe81860ef

  • memory/392-129-0x00000000754C0000-0x000000007550C000-memory.dmp

    Filesize

    304KB

  • memory/392-128-0x0000000006540000-0x000000000658C000-memory.dmp

    Filesize

    304KB

  • memory/392-102-0x0000000005E40000-0x0000000006194000-memory.dmp

    Filesize

    3.3MB

  • memory/976-21-0x0000000004DF0000-0x0000000004E56000-memory.dmp

    Filesize

    408KB

  • memory/976-71-0x0000000007120000-0x000000000713A000-memory.dmp

    Filesize

    104KB

  • memory/976-22-0x0000000004E60000-0x0000000004EC6000-memory.dmp

    Filesize

    408KB

  • memory/976-94-0x0000000074BD0000-0x0000000075380000-memory.dmp

    Filesize

    7.7MB

  • memory/976-20-0x0000000004D50000-0x0000000004D72000-memory.dmp

    Filesize

    136KB

  • memory/976-17-0x00000000050F0000-0x0000000005718000-memory.dmp

    Filesize

    6.2MB

  • memory/976-88-0x0000000007440000-0x0000000007448000-memory.dmp

    Filesize

    32KB

  • memory/976-86-0x0000000007360000-0x0000000007374000-memory.dmp

    Filesize

    80KB

  • memory/976-85-0x0000000007350000-0x000000000735E000-memory.dmp

    Filesize

    56KB

  • memory/976-84-0x0000000007320000-0x0000000007331000-memory.dmp

    Filesize

    68KB

  • memory/976-83-0x00000000073A0000-0x0000000007436000-memory.dmp

    Filesize

    600KB

  • memory/976-82-0x0000000007190000-0x000000000719A000-memory.dmp

    Filesize

    40KB

  • memory/976-35-0x0000000074BD0000-0x0000000075380000-memory.dmp

    Filesize

    7.7MB

  • memory/976-47-0x0000000074BD0000-0x0000000075380000-memory.dmp

    Filesize

    7.7MB

  • memory/976-70-0x0000000007760000-0x0000000007DDA000-memory.dmp

    Filesize

    6.5MB

  • memory/976-16-0x0000000074BD0000-0x0000000075380000-memory.dmp

    Filesize

    7.7MB

  • memory/976-56-0x0000000006D90000-0x0000000006DC2000-memory.dmp

    Filesize

    200KB

  • memory/976-57-0x0000000075480000-0x00000000754CC000-memory.dmp

    Filesize

    304KB

  • memory/976-67-0x0000000006D70000-0x0000000006D8E000-memory.dmp

    Filesize

    120KB

  • memory/976-68-0x0000000006DD0000-0x0000000006E73000-memory.dmp

    Filesize

    652KB

  • memory/1732-150-0x0000000007400000-0x0000000007411000-memory.dmp

    Filesize

    68KB

  • memory/1732-151-0x0000000007430000-0x0000000007444000-memory.dmp

    Filesize

    80KB

  • memory/1732-131-0x00000000754C0000-0x000000007550C000-memory.dmp

    Filesize

    304KB

  • memory/1732-149-0x00000000070A0000-0x0000000007143000-memory.dmp

    Filesize

    652KB

  • memory/2092-30-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/3388-46-0x0000000074BD0000-0x0000000075380000-memory.dmp

    Filesize

    7.7MB

  • memory/3388-95-0x0000000074BD0000-0x0000000075380000-memory.dmp

    Filesize

    7.7MB

  • memory/3388-15-0x0000000004660000-0x0000000004696000-memory.dmp

    Filesize

    216KB

  • memory/3388-72-0x0000000075480000-0x00000000754CC000-memory.dmp

    Filesize

    304KB

  • memory/3388-24-0x0000000005690000-0x00000000059E4000-memory.dmp

    Filesize

    3.3MB

  • memory/3388-23-0x0000000074BD0000-0x0000000075380000-memory.dmp

    Filesize

    7.7MB

  • memory/3388-87-0x00000000072E0000-0x00000000072FA000-memory.dmp

    Filesize

    104KB

  • memory/3388-19-0x0000000074BD0000-0x0000000075380000-memory.dmp

    Filesize

    7.7MB

  • memory/3388-50-0x0000000005C70000-0x0000000005C8E000-memory.dmp

    Filesize

    120KB

  • memory/3388-51-0x0000000005C90000-0x0000000005CDC000-memory.dmp

    Filesize

    304KB

  • memory/4064-7-0x0000000006600000-0x0000000006612000-memory.dmp

    Filesize

    72KB

  • memory/4064-0-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

    Filesize

    4KB

  • memory/4064-6-0x00000000050B0000-0x00000000050BA000-memory.dmp

    Filesize

    40KB

  • memory/4064-5-0x0000000074BD0000-0x0000000075380000-memory.dmp

    Filesize

    7.7MB

  • memory/4064-4-0x00000000051A0000-0x000000000523C000-memory.dmp

    Filesize

    624KB

  • memory/4064-3-0x0000000005100000-0x0000000005192000-memory.dmp

    Filesize

    584KB

  • memory/4064-9-0x0000000074BD0000-0x0000000075380000-memory.dmp

    Filesize

    7.7MB

  • memory/4064-2-0x00000000056B0000-0x0000000005C54000-memory.dmp

    Filesize

    5.6MB

  • memory/4064-8-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

    Filesize

    4KB

  • memory/4064-49-0x0000000074BD0000-0x0000000075380000-memory.dmp

    Filesize

    7.7MB

  • memory/4064-10-0x0000000007D60000-0x0000000007DBE000-memory.dmp

    Filesize

    376KB

  • memory/4064-1-0x0000000000740000-0x00000000007D6000-memory.dmp

    Filesize

    600KB

  • memory/4288-99-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

    Filesize

    72KB