Overview

overview

10

Static

static

10

Client.exe

windows7-x64

10

Client.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27-12-2024 04:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client.exe

  • Size

    73KB

  • MD5

    f5f6281bdd8312649df47aa5ff51817b

  • SHA1

    7dbfee0746f5fff27fe4aef4689655bb95ceec9b

  • SHA256

    c01d9f0b0e36df6209dd32216dc5c23732de1ee7c8c5d94532216d1725573ba5

  • SHA512

    5789255bd6d9252fff6b9aa4a3d83f8de3f75f289a1829678b6f425811491b1c6ff749600e5e115e3635105106307a41041aedbaa5bb10e4a7b998440b3fe9b0

  • SSDEEP

    1536:YUN8cxQFvCr6PMVWe9VdQkhDIyH1bf/lOQzcX3VclN:YUOcxQxs6PMVWe9VdQgH1bfNOQilY

Score
10/10
asyncratvenomratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

homiplaglliddnwuc

Attributes
  • delay

    1

  • install

    true

  • install_file

    Adobe Updater.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/8haaGvJp

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • VenomRAT 3 IoCs

    Detects VenomRAT.

    rat
  • Venomrat family
    venomrat
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2824
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Adobe Updater" /tr '"C:\Users\Admin\AppData\Roaming\Adobe Updater.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2644
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "Adobe Updater" /tr '"C:\Users\Admin\AppData\Roaming\Adobe Updater.exe"'
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2548
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp64FA.tmp.bat""
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2880
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:2532
      • C:\Users\Admin\AppData\Roaming\Adobe Updater.exe
        "C:\Users\Admin\AppData\Roaming\Adobe Updater.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp64FA.tmp.bat
    Filesize

    157B

    MD5

    65fa846e92e14c06ededb349c5c115c3

    SHA1

    640c7b0033c9451b5d7e53925ce4b41afb70b9f0

    SHA256

    d0a81fdb80b13511fcc7b130696fe9c33de4ba50883b14b6b0de231daf33557e

    SHA512

    ec033467a15da033b3ee0a2b17499a0e8ba4856b2bb5700ab65c05e1ed4801efaed4493b112e8e7f862bba5d8e9255e42de01f153fac6485260ebe7b20db761e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
    Filesize

    8B

    MD5

    cf759e4c5f14fe3eec41b87ed756cea8

    SHA1

    c27c796bb3c2fac929359563676f4ba1ffada1f5

    SHA256

    c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

    SHA512

    c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

    Download Submit

  • \Users\Admin\AppData\Roaming\Adobe Updater.exe
    Filesize

    73KB

    MD5

    f5f6281bdd8312649df47aa5ff51817b

    SHA1

    7dbfee0746f5fff27fe4aef4689655bb95ceec9b

    SHA256

    c01d9f0b0e36df6209dd32216dc5c23732de1ee7c8c5d94532216d1725573ba5

    SHA512

    5789255bd6d9252fff6b9aa4a3d83f8de3f75f289a1829678b6f425811491b1c6ff749600e5e115e3635105106307a41041aedbaa5bb10e4a7b998440b3fe9b0

    Download Submit

  • memory/796-19-0x0000000001170000-0x0000000001186000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2824-0-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2824-1-0x0000000001160000-0x0000000001176000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2824-3-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2824-11-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2824-13-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

    Filesize

    9.9MB

    Download