Overview

overview

10

Static

static

10

staffbesting.rar

windows7-x64

10

staffbesting.rar

windows10-2004-x64

10

Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    29/01/2025, 18:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    staffbesting.rar

  • Size

    358KB

  • MD5

    961e2434f73d1ea24c9e390f839a2bf7

  • SHA1

    5e5127fc1fb752d41b5e4feffa720272c884ae37

  • SHA256

    644bf15ecd1fe95c3c559e130a2423618235661befac49ec017197936bf5efda

  • SHA512

    07d7d71d3e7ec6c94cc4733112a65f0b5c0eb112092de8ea70e5f54b2c5c2cd7002323f9bcd8f2de781114be4d70ba5b8c16fabea9d8defa939ee1d5c629f586

  • SSDEEP

    6144:50+LWIOQmUayBeHhBSN44WSuyltW5T0LGycZegsXz8HAVJbXHGSB2:50+L9OQtFNmriW5ILGbZQD8HAfme2

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

zzzxbdsybzu

Attributes
  • c2_url_file

    https://paste.ee/r/COm4hFYr/0

  • delay

    1

  • install

    true

  • install_file

    Systeam.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Async RAT payload 1 IoCs
    rat
  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\staffbesting.rar"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Users\Admin\AppData\Local\Temp\7zO844422B7\STAFFBESTING ULTIMATE.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO844422B7\STAFFBESTING ULTIMATE.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zO844422B7\STAFFBESTING ULTIMATE.exe
    Filesize

    236KB

    MD5

    f199439ba1c1e5b9ac2d9f55210cbd4a

    SHA1

    9ce26a30466e732d16d840842fae2d6f1adae673

    SHA256

    792a486598d655e04f11104c4262a6c0db8f28538799acccc7b3a169b6e533dc

    SHA512

    96d662eec309cfec6e317007945378be5d56490d34efa0b5e44a3691d1759ebea39aad277ee6e34b52c80d8bb600f88c12ef8002a80bf4ed316909659b15d7eb

    Download Submit

  • memory/2964-11-0x0000000000D00000-0x0000000000D40000-memory.dmp

    Filesize

    256KB

    Download