asyncrat | c18c44daf036132179aede5564b5bbc5c084098810d59c1faa887bed8808071c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 21:37

Target

venom_Slayed.exe
Size

14.3MB
MD5

4567a07541f154463aa3e8beea6d20f2
SHA1

f1247d42db0f1c76746f10c41930e0131a5db263
SHA256

c18c44daf036132179aede5564b5bbc5c084098810d59c1faa887bed8808071c
SHA512

cdcb3db1fddd19c4c35d991e57a2695944ee003ac0851493cd118883da3783f8397c4898ebc41f729f2af7678df0332958440ceb71c395fbf72411d79645ccdc
SSDEEP

196608:cjUSwovYlSCLWyFkHY0/+SifhLkNPFCZZwiJl1NLIsPA8fxvuIMzd/95UhS1nUzE:cdP+Zw6NLIsFfskh1BmXGkjP

Score

10^/10

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

VenomRAT 1 IoCs

Detects VenomRAT.

resource	yara_rule
behavioral1/memory/2308-1-0x0000000001110000-0x0000000001F66000-memory.dmp	VenomRAT

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2596	2308	venom_Slayed.exe	31
PID 2308 wrote to memory of 2596	2308	venom_Slayed.exe	31
PID 2308 wrote to memory of 2596	2308	venom_Slayed.exe	31

C:\Users\Admin\AppData\Local\Temp\venom_Slayed.exe
"C:\Users\Admin\AppData\Local\Temp\venom_Slayed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2308 -s 528
  2⤵
  PID:2596

memory/2308-0-0x000007FEF5D33000-0x000007FEF5D34000-memory.dmp

Filesize
4KB

Download
memory/2308-1-0x0000000001110000-0x0000000001F66000-memory.dmp

Filesize
14.3MB

Download