Analysis
-
max time kernel
98s -
max time network
148s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
-
submitted
07-01-2025 18:04
General
-
Target
Client.exe
-
Size
74KB
-
MD5
ada5f28c5c663598558b0fdc4e134cc7
-
SHA1
d86c18f49912d7885c9e61e85778638ed594f4ee
-
SHA256
2a85bd342b1219dd67182c45e659b4c7a25cf17e15a7748217ec01490b67819f
-
SHA512
9f5051d93d2f52cde3f3e5e230428bce33389091ea4b76a3f1020d5a51aebf274ea0f0e979f6681b7a5eaa8f8b92b2c2b51c9802846feda07ec15a8bf003d91f
-
SSDEEP
1536:8UUPcxVteCW7PMVee9VdQuDI6H1bf/q6InQwQzcBLVclN:8UmcxV4x7PMVee9VdQsH1bfC5QYBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
18.158.58.205:18272
tiekizaeiydrbws
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
10.8MB
-
Filesize
10.8MB