Overview

overview

10

Static

static

10

1aac014bf0...aN.exe

windows7-x64

10

1aac014bf0...aN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/01/2025, 05:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1aac014bf02948e57db6011a42380afdae5c5e417e3a611a83c9c978e94a5ccaN.exe

  • Size

    63KB

  • MD5

    22975c8d49fbbd920ebad017075e7240

  • SHA1

    aa18b7db713f4ef1732e2737be8a62097cbb17e0

  • SHA256

    1aac014bf02948e57db6011a42380afdae5c5e417e3a611a83c9c978e94a5cca

  • SHA512

    d5069d5f9e1b84b7e0140a5ea5c374a60111e50365216f98bf86ae958a209d0d7b8a8ac43148ffb1dd79aa253337e2e598b7493e638559e2f7dc97cc3374c7c2

  • SSDEEP

    1536:ihODHQtSfGafqCg7mOxjGbbswVLdMCGiDpqKmY7:ihODHQtSzfc7bhGbbsidMggz

Score
10/10
asyncratvenom clientsrat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

127.0.0.1:35000

88.167.109.19:35000
Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    true

  • install_file

    serv.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1aac014bf02948e57db6011a42380afdae5c5e417e3a611a83c9c978e94a5ccaN.exe
    "C:\Users\Admin\AppData\Local\Temp\1aac014bf02948e57db6011a42380afdae5c5e417e3a611a83c9c978e94a5ccaN.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2156-0-0x000007FEF5B43000-0x000007FEF5B44000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2156-1-0x0000000000140000-0x0000000000156000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2156-2-0x000007FEF5B40000-0x000007FEF652C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2156-3-0x000007FEF5B40000-0x000007FEF652C000-memory.dmp

    Filesize

    9.9MB

    Download