Analysis
-
max time kernel
900s -
max time network
440s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
02-01-2025 10:23
General
-
Target
Pictures (1).rar
-
Size
40KB
-
MD5
925b435f22cfd50be40be5b7532a1689
-
SHA1
a128cbed022405d5cc146229f102ce142fabd17a
-
SHA256
966ddc6a758daca9f38b84847cc89843158315af24d659e4bc3f8b84603cc81d
-
SHA512
6d6c279db247b42185b38887f4cca94a7b930655999d311181fbe61270337fabb3dbdfb3ecfaa8397205a1f042e28d38fdf0819e39756606bdf138112fd755d5
-
SSDEEP
768:yglM/6eKEtD/+K8JgIiMw4Ekt+uKoUKX5Q3cSojiDttGRoCGAYwlGb:yaeL/FMw5NoUKX5QM94ERI
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
127.0.0.1:4449
127.0.0.1:0
nlrwwlvabqvx
-
delay
1
-
install
false
-
install_folder
%Temp%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Async RAT payload 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Pictures (1).rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Pictures (1)\The Kids.exe"C:\Users\Admin\Desktop\Pictures (1)\The Kids.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Pictures (1)\The Kids.exe"C:\Users\Admin\Desktop\Pictures (1)\The Kids.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
82KB
MD531300efe3208bfb67a72bdfdf37eead7
SHA1e30193d2aa57411c7e26697177de59c0f8b66b33
SHA256af053b9107669f49242369eeb397b935c45f867bce98c631bf2247cc5b0f400b
SHA51280eb5827a1ae337374b1a5ec0af14b93eeabf3c3d99397de64e2e821c2467eeaecba92598e47c90187a4cd1544c4096c07dbb6ad7e3e8b430900327bd14bcae0
-
Filesize
8KB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB