Analysis

  • max time kernel
    117s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:13

General

  • Target

    7b545826d4c80e7dc461ebae6c6dd9a3ddadec34a907d988744a485390bd6d54.exe

  • Size

    2.6MB

  • MD5

    06d1930575f5e3d2ef24b09275650dd3

  • SHA1

    f721980b35e51016f088d394c32df3aaef08e557

  • SHA256

    7b545826d4c80e7dc461ebae6c6dd9a3ddadec34a907d988744a485390bd6d54

  • SHA512

    4f036899fda417edfd5c82582f4c5abe9790c70d9e009003f039aafffd874353196266d4aca9667913bcc149cd8ed4a488ec7c42fed6b73a2c25f949a80a3205

  • SSDEEP

    49152:eapljSe2SpnpDL39r34BR1kg0wQYhD/Nhoa9Tx4gb:eElnp9L39r34BR1kg0wQsDVzTx4gb

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

147.185.221.27:3368

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    true

  • install_file

    Update.exe

  • install_folder

    %Temp%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b545826d4c80e7dc461ebae6c6dd9a3ddadec34a907d988744a485390bd6d54.exe
    "C:\Users\Admin\AppData\Local\Temp\7b545826d4c80e7dc461ebae6c6dd9a3ddadec34a907d988744a485390bd6d54.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2616
    • C:\Users\Admin\AppData\Local\Temp\7b545826d4c80e7dc461ebae6c6dd9a3ddadec34a907d988744a485390bd6d54.exe
      "C:\Users\Admin\AppData\Local\Temp\7b545826d4c80e7dc461ebae6c6dd9a3ddadec34a907d988744a485390bd6d54.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:5108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2616-0-0x00000000743FE000-0x00000000743FF000-memory.dmp

    Filesize

    4KB

  • memory/2616-1-0x0000000001330000-0x00000000015DC000-memory.dmp

    Filesize

    2.7MB

  • memory/2616-2-0x00000000011E0000-0x000000000130E000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-5-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-9-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-7-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-19-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-41-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-49-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-31-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-63-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-67-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-65-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-61-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-60-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-55-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-53-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-51-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-47-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-45-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-44-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-39-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-37-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-35-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-34-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-29-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-27-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-25-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-23-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-17-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-15-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-13-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-11-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-57-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-21-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-4-0x00000000011E0000-0x0000000001308000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-3-0x00000000743F0000-0x0000000074ADE000-memory.dmp

    Filesize

    6.9MB

  • memory/2616-24386-0x00000000743FE000-0x00000000743FF000-memory.dmp

    Filesize

    4KB

  • memory/2616-24387-0x00000000743F0000-0x0000000074ADE000-memory.dmp

    Filesize

    6.9MB

  • memory/2616-24388-0x00000000743F0000-0x0000000074ADE000-memory.dmp

    Filesize

    6.9MB

  • memory/2616-24401-0x00000000743F0000-0x0000000074ADE000-memory.dmp

    Filesize

    6.9MB

  • memory/5108-24402-0x00000000743F0000-0x0000000074ADE000-memory.dmp

    Filesize

    6.9MB

  • memory/5108-24400-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/5108-24403-0x00000000743F0000-0x0000000074ADE000-memory.dmp

    Filesize

    6.9MB

  • memory/5108-24404-0x00000000743F0000-0x0000000074ADE000-memory.dmp

    Filesize

    6.9MB