Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-01-2025 06:29
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
Client.exe
-
Size
78KB
-
MD5
39afdfecb59c1dc6656f76a458e91684
-
SHA1
e7e99b64fcbbd4faecad0e953b22147040293ef5
-
SHA256
d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a
-
SHA512
30a05fb653d38f2093a7b45dffd93141890a0d378c616aaa5045ab21899730169e2cf21d4fb98a18df9fdfa9775b9c002f973d79e230053dbce6c28d7f29211f
-
SSDEEP
1536:kn9Otw9zJ14+qkEAjR7XBWPz5Gq8mzOD1btS6JAduU1:kn9O+jq+q1ABXGmm6D1btZPq
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
Mutex
dmcszhekydwkmqm
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/6ZBHT1SN
aes.plain
Signatures
-
Asyncrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 44 IoCs
flow ioc 4 pastebin.com 7 pastebin.com 32 pastebin.com 34 pastebin.com 30 pastebin.com 33 pastebin.com 43 pastebin.com 8 pastebin.com 9 pastebin.com 18 pastebin.com 19 pastebin.com 24 pastebin.com 47 pastebin.com 31 pastebin.com 5 pastebin.com 11 pastebin.com 15 pastebin.com 16 pastebin.com 26 pastebin.com 17 pastebin.com 20 pastebin.com 25 pastebin.com 39 pastebin.com 41 pastebin.com 14 pastebin.com 37 pastebin.com 44 pastebin.com 46 pastebin.com 35 pastebin.com 36 pastebin.com 6 pastebin.com 12 pastebin.com 21 pastebin.com 28 pastebin.com 29 pastebin.com 10 pastebin.com 13 pastebin.com 22 pastebin.com 38 pastebin.com 42 pastebin.com 23 pastebin.com 27 pastebin.com 40 pastebin.com 45 pastebin.com -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe -
Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe 2380 Client.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2380 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2380 Client.exe