Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-01-2025 05:45
Behavioral task
behavioral1
Sample
d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe
-
Size
78KB
-
MD5
39afdfecb59c1dc6656f76a458e91684
-
SHA1
e7e99b64fcbbd4faecad0e953b22147040293ef5
-
SHA256
d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a
-
SHA512
30a05fb653d38f2093a7b45dffd93141890a0d378c616aaa5045ab21899730169e2cf21d4fb98a18df9fdfa9775b9c002f973d79e230053dbce6c28d7f29211f
-
SSDEEP
1536:kn9Otw9zJ14+qkEAjR7XBWPz5Gq8mzOD1btS6JAduU1:kn9O+jq+q1ABXGmm6D1btZPq
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
Mutex
dmcszhekydwkmqm
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/6ZBHT1SN
aes.plain
Signatures
-
Asyncrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 48 IoCs
flow ioc 20 pastebin.com 27 pastebin.com 50 pastebin.com 86 pastebin.com 87 pastebin.com 88 pastebin.com 26 pastebin.com 49 pastebin.com 51 pastebin.com 68 pastebin.com 89 pastebin.com 19 pastebin.com 52 pastebin.com 77 pastebin.com 12 pastebin.com 61 pastebin.com 64 pastebin.com 74 pastebin.com 75 pastebin.com 15 pastebin.com 28 pastebin.com 46 pastebin.com 47 pastebin.com 48 pastebin.com 60 pastebin.com 62 pastebin.com 63 pastebin.com 79 pastebin.com 82 pastebin.com 84 pastebin.com 90 pastebin.com 18 pastebin.com 30 pastebin.com 36 pastebin.com 73 pastebin.com 80 pastebin.com 85 pastebin.com 29 pastebin.com 45 pastebin.com 53 pastebin.com 58 pastebin.com 59 pastebin.com 65 pastebin.com 76 pastebin.com 81 pastebin.com 57 pastebin.com 78 pastebin.com 83 pastebin.com -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe -
Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 868 d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe"C:\Users\Admin\AppData\Local\Temp\d9b2a57f408ffac54b1243ef5d0311a3b9548c868d48216195d5c4efbfd53e7a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:868