Analysis
-
max time kernel
124s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/03/2025, 06:13
General
-
Target
7b545826d4c80e7dc461ebae6c6dd9a3ddadec34a907d988744a485390bd6d54.exe
-
Size
2.6MB
-
MD5
06d1930575f5e3d2ef24b09275650dd3
-
SHA1
f721980b35e51016f088d394c32df3aaef08e557
-
SHA256
7b545826d4c80e7dc461ebae6c6dd9a3ddadec34a907d988744a485390bd6d54
-
SHA512
4f036899fda417edfd5c82582f4c5abe9790c70d9e009003f039aafffd874353196266d4aca9667913bcc149cd8ed4a488ec7c42fed6b73a2c25f949a80a3205
-
SSDEEP
49152:eapljSe2SpnpDL39r34BR1kg0wQYhD/Nhoa9Tx4gb:eElnp9L39r34BR1kg0wQsDVzTx4gb
Malware Config
Extracted
asyncrat
5.0.5
Venom Clients
147.185.221.27:3368
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
true
-
install_file
Update.exe
-
install_folder
%Temp%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b545826d4c80e7dc461ebae6c6dd9a3ddadec34a907d988744a485390bd6d54.exe"C:\Users\Admin\AppData\Local\Temp\7b545826d4c80e7dc461ebae6c6dd9a3ddadec34a907d988744a485390bd6d54.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7b545826d4c80e7dc461ebae6c6dd9a3ddadec34a907d988744a485390bd6d54.exe"C:\Users\Admin\AppData\Local\Temp\7b545826d4c80e7dc461ebae6c6dd9a3ddadec34a907d988744a485390bd6d54.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 11643⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4892 -ip 48921⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
517B
MD54d737622dcf53d4cf89810ec284fdf89
SHA1a71b0c3ac6b940047ca7730465c1f97342c8ca08
SHA2567d5529c9d51a138cea4ae46faa32497ccf1e55d6bd5aa43f746d413ce80fa1cb
SHA512acf53d9d2ffe5e3dd34760e3c8e138229ee9805387ddf0765266ee882268cf64f84fb4a1b79aee3f90b88b50f1a1bbf10c9ba7a1013496059b46f3abe9c859c6
-
Filesize
7.7MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
7.7MB
-
Filesize
1.2MB
-
Filesize
7.7MB
-
Filesize
1.2MB
-
Filesize
408KB
-
Filesize
2.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
88KB
-
Filesize
7.7MB
-
Filesize
7.7MB