asyncrat | b460cb71a7c6a0ef8f1f92dc52c237a41a783fa5d2925362eb0ab3db51420e71 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 03:12

Sharing

Report Analysis Logs

General

Target

VenomRAT-V5.6-HVNC/Stub/Client.exe
Size

60KB
MD5

324ef4e2187cb8fb01f9ce7b7803c79c
SHA1

f87c6d87f08fcc78a3a8312bc767f81c397be810
SHA256

a59354e798768e068f79816146d9f7b41e0003c50d5d8c82602fc16a16962999
SHA512

a621a85453ccf5426ec0732b26d238c26cf29466d5f0138bfd725fe922437401223df2b50b18ae96be73b15ba39bce9e61cdfac87a81a97d9e88cd23a845430d
SSDEEP

1536:AcSD4758ocxx8OKNhYEMWyhoTTI+xkrypqKmY7:AcSD475jcxx8OWiovI+xkrRz

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2700	2112	Client.exe	30
PID 2112 wrote to memory of 2700	2112	Client.exe	30
PID 2112 wrote to memory of 2700	2112	Client.exe	30

C:\Users\Admin\AppData\Local\Temp\VenomRAT-V5.6-HVNC\Stub\Client.exe
"C:\Users\Admin\AppData\Local\Temp\VenomRAT-V5.6-HVNC\Stub\Client.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2112 -s 512
  2⤵
  PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-0-0x000007FEF5753000-0x000007FEF5754000-memory.dmp

Filesize
4KB

Download
memory/2112-1-0x0000000000A40000-0x0000000000A54000-memory.dmp

Filesize
80KB

Download