Analysis
-
max time kernel
900s -
max time network
899s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
08-01-2025 17:48
General
-
Target
VenomRAT v6.0.3_p_.rar
-
Size
96.2MB
-
MD5
095a7619dd15a4ae3ff91552089c4b5b
-
SHA1
73a2b56c2d1a558477f133981ea3c84675dccae6
-
SHA256
bb25e7f018e8369b7e9d15e5d2a384cb6768a05cb47f2029e1e80240e2d67fa7
-
SHA512
0d254a0cbb267700b7ea938f302719161af76177e94e6e08301b28fd1fa2e05b7187a4c7bdcc8229326209394314a79058f753a0205a55b83fd17f179a71034d
-
SSDEEP
1572864:CNO4d3H2na2C6+N0kgasoygQmsHhhcD0vMXz//1WEBHAusOvqPow7P2xOhyZGc9i:ED2C6sgatyDjHh5vluXqCmt
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
93.82.44.26:4040
nheplizwdi
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Async RAT payload 2 IoCs
-
Executes dropped EXE 7 IoCs
-
Loads dropped DLL 31 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3_p_.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\VenomRAT v6.0.3_p_\Venom v6.0.3.exe"C:\Users\Admin\Desktop\VenomRAT v6.0.3_p_\Venom v6.0.3.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe"C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\VenomRAT v6.0.3_p_\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\Desktop\VenomRAT v6.0.3_p_\Venom RAT + HVNC + Stealer + Grabber.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Venomrat.exe"C:\Users\Admin\AppData\Local\Temp\Venomrat.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\Desktop\VenomRAT v6.0.3_p_\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\Desktop\VenomRAT v6.0.3_p_\Venom RAT + HVNC + Stealer + Grabber.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\Desktop\VenomRAT v6.0.3_p_\Client.exe"C:\Users\Admin\Desktop\VenomRAT v6.0.3_p_\Client.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\VenomRAT v6.0.3_p_\Venom RAT_p_.exe"C:\Users\Admin\Desktop\VenomRAT v6.0.3_p_\Venom RAT_p_.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1e41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5f6cd31be1b934e979780c63ee6dca10c
SHA17f802a7409345d03bef6d292b91e096a97c7f25a
SHA256c7d808cc2f536c8aef33b34415bffa55d32ecdfb23dd34ec95d76f934c40ea12
SHA512bef7835728afb40e05a322a331b6a7a7f99b37d0dea0d883b4c0afa0e697f0801847680202d19d99f934b29d3b934a6d41a0e623945c7af469fb842354a0c6f9
-
Filesize
14.2MB
MD57e8d3bcd4b3ee0a20deb79e5818f06a0
SHA173acfa8fbe3aa5ab8372cf8d11eba9242ba4592e
SHA256baa304c80cd2acc0df7968024a0754d560dfd2fafc14dfc6383783e3d2f8127e
SHA5122ca9b6ec0f22d586388caf3d4da20e25ba46aac0cee7d6e98f8ddeb3cddbc346d632a3717c6902b065e6fb5d8628ff08f8a306f1ca539f905fbfb1a06f7222c9
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
838KB
MD5e59c802bbbc1ebc554f3f7b6a3259ee1
SHA1fdb4fa99e15d6519f18f7afe972fb2b128c5caf4
SHA256d13e0c266cb9b98a911bbb87fd94cd9e5125e3bff93bb9b1032271e7507ef2f6
SHA51234aa13fd54fa262405e68c5f915192fe02b9d2c6560f36c5a5c93ec399407b47996e2d4ed88c22286cc6d578a4356353a9540a729684272611350c4665119e73
-
Filesize
5.0MB
MD55c3017ec9073a7a4f3351440c3daaa8a
SHA1ee1f73f8618439fc8a42f38b32760367bd5ce6b5
SHA256e8d4940767c992e14acb77ba1140d5dac56683afe5096e1b08408b0767466e33
SHA5125d98631f754067e659400183134024cc2a4c22ba4a43ddf592791e01eca5cf1530eabcc4ee34beb7507c56dd02a80ba4704db389753a3119657e1d822c68c02a
-
Filesize
291KB
MD5cb877cd3b77a37f8e279fe7dc6b4ba6a
SHA1a03989c1144a57e9088daa40f829a49298135b03
SHA256bc0d40dcdcc9f3e2e7b7071ffb033811bb094cc6a63907c994acd5415b577930
SHA5128dbbbe8606bd36c2efd4f456840c9cb5dd4966097f3a6a0e81104fe4a50695adf558612d74fd31978728455f699f6623e73dfd5e3fcd405e0afceebe83ddd97b
-
Filesize
4.5MB
MD59ec835a4e269f978eeefd7fd8bd5abb0
SHA1e36a07167bd83d713703a84f3c2c2b8f86cd38f5
SHA256e4d60cac9cacde3cab841854b4c5348df89a4e4027b62de09184a3ddbb81a5a0
SHA5122a72b3615215b94d1b7fce3c9ff28042c4c02ec655e3fdc42008217979b65f39fff9cb75a35ac1426a78aa2f8c0c00354369cdb5b5df155efcde8651878de4d9
-
Filesize
20.0MB
MD507adc748684fd33a198f2dc6eea12666
SHA128f62a05673447a3a347aa6a01ae8cd518126956
SHA25650cba5304bf0a620c119a610e73f545fee688462860706785db507110739a093
SHA512893829cb3e1a27e5cbcab9a3b7ef290b1ec74cb21fc46358f2a08a3149d54bd34258046ac47387ad5777d794478230bf2605897e7259ac7a0241dc1272e121ab
-
Filesize
13KB
MD5de4449ac523ac31f66efe7f090360f71
SHA1de7fcb8c16c7cab8255b8e31781efb0ffc45acce
SHA25676a868948e5b4df73f5dab5606135f6bf10b598bdaa991737224edcb8fdd58db
SHA512d43021c5878f08c38264e1882313959aa51b8dabf6649a64f476f3e7c0ba7fdaaac0f3edaa6fb3ea2e56889a5e78791236c1dfe8dbcd9218d7eab30a9ee4a56c
-
Filesize
6.5MB
MD58f335dc88eb706a7b50f45a3fd308dee
SHA11bcfb26b7e945fe29f40a1f2ad19c4be4d590edd
SHA2563f31296a5be7c607874f4fd3e66df9d2c460edbc5c4b41ee5ce93534786310ac
SHA5120d42472c287497878a08393b1b39608c0f466520b1ed9aac83fdbd25171941d40d0d0eb1012503894aaac5a5b64db7ea8d280df6d5f7afdd15490d4cee97ea00
-
Filesize
7.7MB
MD59a4fa4e33d64f44451fc4223a5616355
SHA1124caceb4e82537403a4b5e9b21487c369b69559
SHA256fc4e229d2237af90eb1b76205b543098ee958cbc7558d7a6dab41b5210fdaef5
SHA512869b25aa356a957ba361b4fcc1b3aa8363e7bd23a577538f904995ebaebb8a249398e35cf381f5ba06baed95c8dd3e5d6e3aea8efe5ac8e48ca2482c9d549bf9
-
Filesize
3.6MB
MD58478f5aa3de612bd2cf5e9356688d0f3
SHA184103d2abee8976dcaac172bcb9e064dfd06a890
SHA256ae22e7bebe5c4b59363c5980940c64608d1a35c6b5026e0e088605132187c8da
SHA512d0f3cbf8144c733266e05b2513603f5b44bf6fa359bbff86c3d437e022ef1d6451ce7b3f335d116438346aeb3d93bc5a82a6a548a7b1795f72991112abe6750f
-
Filesize
2.0MB
MD545d8d7bd5e30d8b5da44f6a60e331c87
SHA1301d5dc4a8a1141234559df872ce219c1c7efccb
SHA256e6e670bf76dc46e959f74b09d3c6e614b2121975456b00041e32bd7f5001253f
SHA51223b303f287e0b77d221e8cd24cf2933d4976e9b61dfc9bd03c9f365d44988a0a7ce2e81366466dcdff981931099964ebc04293de2de039e0322eed9ac911291b
-
Filesize
10KB
MD5b8607b7921cd9cba78058fcb56bcfb9d
SHA11344f12ff7e23122b62fcc7f3be548c73d3c3efd
SHA256b2a992052d32a5b9d3702350b133289b45a8d209acd0161d9c3b0bc6fd702b3c
SHA512dd36040e57f2744437684e257caac0987a90deac0a60536f1cb8d690e256505d427931a3beb8d58f87c2c1bf5beb0a40c4b09417c451a07e5856044efbac1449
-
Filesize
16KB
MD506247396be54c6ebb06fd6ca84ee80cc
SHA151fb23ff498a47c0be900ae43a7030f98794eb59
SHA256669e42b6c6e94dc2735f281aa5b33c0d398b91960158ec556e521974b3be5843
SHA51203d93f22aaf1bc0dc4d26b130aa1cb1668c14b854ff84803c8b2cc74625cda44970dd5be1b17865986eabb6966a7d65c226282becfd7963b72b8035990ffc299
-
Filesize
14.2MB
MD5fb902fb0843e4f12d068b3bcd08b2e77
SHA196038a62a3ea6da4f11981f80ce4961ff50fbe4d
SHA2562743f6791b5a525252a3e138d05ecda170d0fa758e1616cf96335648c572f068
SHA5122c188572aadc906c6971ec13f0ae7b9f79c6a88a2fd34add00ee1b2d74f14cf895a86d2ba47036a1b1e7c8e00cd5adb0387baaea7fd5e5f93feaed98bb1dc6f6
-
Filesize
3KB
MD5a1c2a2870001b66db41bcb020bff1c2d
SHA18c54c6a3564c8892aa9baa15573682e64f3659d9
SHA2560aa9e3ab5c88c5761120206eff5c6e35c90288290b3647a942059705ef5b75e5
SHA512b3bf53120203cfaa951f301b532849cb382d2404c9503916bc1ca39925a9a1530b01045f341fc75d47d65130d0187dcbbf4288b9ef46aa81624b59ba7802794b
-
Filesize
14.3MB
MD5f847c6b988dcc932d1a31171160cf69e
SHA11b40d91ad3ef9b5e4174aec276f906fe9adda9ed
SHA256d75d343cc6593b2cbcd2b64963d8ba7764b9517a12298baea07c0efc6252b0a8
SHA51225dc413fa52556e7792eeea575a0654927204fb1d53b5110baee1da7f1ca67fa0c466970021ab4d173f231c41e8c321a991dd4124a0a1d6f9f8db990826087a9
-
Filesize
1KB
MD565efef16af8b2bb993e24ca1fdb3f3a7
SHA1e205dcc888582eb51d0ee9690d37a7b75138f715
SHA256c40f74c79715de4c5265dffd643d7bd5dda2caa09ca84e620bc78f7d27df51fc
SHA51229581484c44849ccd0ad9bd2c9058fc56f3589019baf4b833a5fc8ceea0e488a357639c92cbaf977f74d5f2d59abb2b8ee7a607cdc67c6c14592b4bd9c3a5215
-
Filesize
2.3MB
MD56d6e172e7965d1250a4a6f8a0513aa9f
SHA1b0fd4f64e837f48682874251c93258ee2cbcad2b
SHA256d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
SHA51235daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
-
Filesize
1.1MB
MD55cc2bb48b5e8c8ac0b99669401d15456
SHA102e9ae08f3ec364834eb3ffc122f1c90e1b0e95e
SHA256648950f725fb0320e09c52dcaf81764916df96dc62e7429ba67daea0acb784ea
SHA5122867e94cee9f89f1cf85ad01083d75f4bc0bc0e551b2ffae05581828994f2b01a458ac7a7c94a45e8c40858ecce197f7ec23482ee13ef3f1bf82b33b89b3b420
-
Filesize
73KB
MD55d6802a39c1bea84e1bd3e6ba23b7bbb
SHA117b6040dcd0dc6c0cf794b6d95ed4da0f07ef0b9
SHA256d1fd56cb9943f5b185c8ee52a34f7ea4d34c5091f77ea18138f1d13a8951dd5e
SHA51255df1ab721022d363b6d454ab496b7cc542702edda0525037cc8f0c33a1d93bc50ed62be8d4b95ba1248d7fee5b806d599ddce5e3ff6a9d4464e3047a0ee799d
-
Filesize
118KB
MD52612a0586acb1b3e7b5c13aad79504fe
SHA18a8ac9ce4b3a174f46b69fd16bad04c5f3044e24
SHA256e7c76c52a3e9f751ed6ed9c9231e35228a636ebd68726241a843f31c5a41ec0c
SHA512fb6d49a3c5051c12a9bdc23f5d0b0450cada30b54fc557e83b55280a5ccefe00a30f9a641c65bca42f2cc1eed30ada4eabd07e97814df715f1ce9b2f046aefce
-
Filesize
71KB
MD533aa30124ec0b36f1a9319cd62a11e84
SHA1f8181335be708048b28cf1540054a5dd9d6acf8c
SHA256c6a8838b3619db76fc89af6bbd9188f868557348b3d06e2815eae2882dae8ec3
SHA512fceed2946791b47eb3e9f5b94fb11104abdc6bd8c2ae3c4c4694880af168608822a0b77ceecaeda125a04ffe2fcc081bf0e003c17ba3dc34a6ad261d45da7e65
-
Filesize
14.2MB
MD53b3a304c6fc7a3a1d9390d7cbff56634
SHA1e8bd5244e6362968f5017680da33f1e90ae63dd7
SHA2567331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58
SHA5127f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5
-
Filesize
5.1MB
-
Filesize
864KB
-
Filesize
40KB
-
Filesize
3.6MB
-
Filesize
4.5MB
-
Filesize
7.7MB
-
Filesize
14.2MB
-
Filesize
320KB
-
Filesize
20.0MB
-
Filesize
6.6MB
-
Filesize
2.1MB
-
Filesize
2.3MB
-
Filesize
88KB
-
Filesize
14.2MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
864KB
-
Filesize
4.5MB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
3.6MB
-
Filesize
2.1MB
-
Filesize
2.3MB
-
Filesize
5.1MB
-
Filesize
6.6MB
-
Filesize
20.0MB
-
Filesize
40KB
-
Filesize
14.2MB
-
Filesize
96KB