Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
29/03/2025, 19:45 UTC
General
-
Target
6bf8ec1cf3a7bb15d7f0cc5408dc9ba25226ca0456edde5c5ff3e0e785e1a7cd.exe
-
Size
63KB
-
MD5
9dd10f9335e7979d2a90b3ab9106d261
-
SHA1
2633da3549195050d665d0fd3eefd96dcb15470d
-
SHA256
6bf8ec1cf3a7bb15d7f0cc5408dc9ba25226ca0456edde5c5ff3e0e785e1a7cd
-
SHA512
acc081e163e92f5c06d7185053b85e288639462486c85c718fd619cdce8fd84943735f597165b20045160c078144de88ef6178012f17bf2ebc7c47d5aada6ba8
-
SSDEEP
1536:OBVb3plA0aTdeKX7QNaoxvGbbnwKbn2BGtkpqKmY7:OBVb3plA0aTRX7QDtGbbnfj22vz
Malware Config
Extracted
asyncrat
5.0.5
Venom Clients
127.0.0.1:4449
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
true
-
install_file
scs2.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Async RAT payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bf8ec1cf3a7bb15d7f0cc5408dc9ba25226ca0456edde5c5ff3e0e785e1a7cd.exe"C:\Users\Admin\AppData\Local\Temp\6bf8ec1cf3a7bb15d7f0cc5408dc9ba25226ca0456edde5c5ff3e0e785e1a7cd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "scs2" /tr '"C:\Users\Admin\AppData\Roaming\scs2.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "scs2" /tr '"C:\Users\Admin\AppData\Roaming\scs2.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp6CD7.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\scs2.exe"C:\Users\Admin\AppData\Roaming\scs2.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
- No results found
-
127.0.0.1:4449 -
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
-
127.0.0.1:4449
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD55d427e4a99afa006cf3a5b2b39a32add
SHA156841773ce852091aa3de07b4056e0ed31e4eef0
SHA2563575fbd2d105328eb36ddf4f185abf97db1f69f7fbf3831221bd3c8ce529d529
SHA51254cd93cec1efc0f426b11f7362a200e02146d3f0e090bd2aff3ccdedda2e5e1e04433b06a7c9b50836132b6dfc2a99b937e1b0f2b2274df17c02859c2afadd66
-
Filesize
63KB
MD59dd10f9335e7979d2a90b3ab9106d261
SHA12633da3549195050d665d0fd3eefd96dcb15470d
SHA2566bf8ec1cf3a7bb15d7f0cc5408dc9ba25226ca0456edde5c5ff3e0e785e1a7cd
SHA512acc081e163e92f5c06d7185053b85e288639462486c85c718fd619cdce8fd84943735f597165b20045160c078144de88ef6178012f17bf2ebc7c47d5aada6ba8
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB