Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 19:18

General

  • Target

    c70e86cf184a8f7486b48897da54f4652fdd2d8f71ee9084ed7a4c6620be10e9.exe

  • Size

    74KB

  • MD5

    fd5acfc89a8f9d7c1ed6fea61f0ddf23

  • SHA1

    68829b58f10717f467ff98c4f10475d099d6b0f9

  • SHA256

    c70e86cf184a8f7486b48897da54f4652fdd2d8f71ee9084ed7a4c6620be10e9

  • SHA512

    5af3ebc444bfc5ac09b45eca94fcc114036cd550b48fd08dda0abf09cc2e1fc8b192d897a96fe939618edb4c64da2c316c0f89530b2e5246c45910824281400c

  • SSDEEP

    1536:8UUPcxVteCW7PMVee9VdQuDI6H1bf/neQLJqQzcBLVclN:8UmcxV4x7PMVee9VdQsH1bfPfLJqQYBY

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

147.185.221.25:45714

Mutex

pxgdsrtuon

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • VenomRAT 1 IoCs

    Detects VenomRAT.

  • Venomrat family
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c70e86cf184a8f7486b48897da54f4652fdd2d8f71ee9084ed7a4c6620be10e9.exe
    "C:\Users\Admin\AppData\Local\Temp\c70e86cf184a8f7486b48897da54f4652fdd2d8f71ee9084ed7a4c6620be10e9.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2352-1-0x0000000000560000-0x0000000000578000-memory.dmp

    Filesize

    96KB

  • memory/2352-0-0x00007FFD66523000-0x00007FFD66525000-memory.dmp

    Filesize

    8KB

  • memory/2352-3-0x00007FFD66520000-0x00007FFD66FE1000-memory.dmp

    Filesize

    10.8MB

  • memory/2352-4-0x00007FFD66523000-0x00007FFD66525000-memory.dmp

    Filesize

    8KB

  • memory/2352-5-0x00007FFD66520000-0x00007FFD66FE1000-memory.dmp

    Filesize

    10.8MB