Analysis
-
max time kernel
54s -
max time network
59s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
30/03/2025, 19:26
General
-
Target
477f89cc7690210c0e3f3cee9f562708092b3770539367555ecd2b84b2699a96.exe
-
Size
7.5MB
-
MD5
947eabafe59955146fdb714a09e74896
-
SHA1
a229cea1a129676f7b7c3c7bc80a28e9c22268aa
-
SHA256
477f89cc7690210c0e3f3cee9f562708092b3770539367555ecd2b84b2699a96
-
SHA512
814a1ed776ae4dbff873cb61e72cad9b71fd8f813e38b203b7a68f351627685320aadaccfee160d2faa2f2867c492ce2428d0331aebfed6eacdc950b618a1e98
-
SSDEEP
196608:TOIe9o8SdDSPvb9FLZmFZKPzs+l8By5k4SFn0r:yHm8Sd0FNm+bs2C4yn0r
Malware Config
Extracted
asyncrat
5.0.5
Venom Clients
178.117.80.225:3998
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Async RAT payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 6 IoCs
-
Modifies registry class 30 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\477f89cc7690210c0e3f3cee9f562708092b3770539367555ecd2b84b2699a96.exe"C:\Users\Admin\AppData\Local\Temp\477f89cc7690210c0e3f3cee9f562708092b3770539367555ecd2b84b2699a96.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller (2).exe"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller (2).exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe" -app -clientLaunchTimeEpochMs 0 -isInstallerLaunch 46483⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
MD5a679a17f732d6c4e4799f4c2a5c00b4d
SHA179778557030a4ce1f0a31f1d93878c931bc932fa
SHA2566472c6e314e51269d9455fbeddb982a6af07269420c23fbb09d2fbdbff49dcc5
SHA512ee1843c3c4be3c1b82629d45432748b2e84c3025a19cf65fb9f80b6ac214a2d1411152a4ae196d5b02fe535bf6aecf2ee2a898f475394cc23815a30d81e679db
-
Filesize
14.9MB
MD5708a873f0b36b02b8e92f738d414b918
SHA14ca5646a00859ca875b93ab0b111265684a74c74
SHA256485c0ed2fbbf74c7b18d95e4800da48f2bc90a030551ca21cb2060bf092e1679
SHA51201af8f6e0cc2586382acaab92c094bbf9b6d735c0a1a9f2bed678e700026209331bc77d3541f6db462e5daf8846dc2f5779361dd7082ed17845386d177cb6a3d
-
Filesize
154KB
MD5577f05cd683ed0577f6c970ea57129e0
SHA1aedf54a8976f0f8ff5588447c344595e3c468925
SHA2567127f20daa0a0a74e120ab7423dd1b30c45908f8ee929f0c6cd2312b41c5bddf
SHA5122d1aea243938a6a1289cf4efcd541f28ab370a85ef05ed27b7b6d81ce43cea671e06a0959994807923b1dfec3b382ee95bd6f9489b74bba59239601756082047
-
Filesize
7.9MB
MD5d3ce7ba8150c6b4ed1ad1212fd1c021a
SHA1703ccb1beb53288f7d6da1294c5fd5a0e6e3a56a
SHA256327f6d9ac087b0614239a9234981a015b09a108bdc0dd97a2ae72bb1ce6faa5f
SHA512606d6a8bf1c51247f78b7a2ecff7027b08059814df54f40c461241cc9254d31df08d24f1f0b66570849ad84993baf7dce9c10e02f91071834ab8269e76e8ffa9
-
Filesize
63KB
MD5065916df76a29b60fae9879d48f6a23c
SHA139955f523f47653e72758e4a504ba2b28f65ae67
SHA256281246ed2415cc6b47bdaa3af0910a7f0fc97a854e4b146a88469b97225bda9b
SHA512dbf17e5ed7cc22b80ccc2626dc33206d207432bc18693e51d7ecf86a93b2a8ebfc25842fecdbe69d1379bc3218f4a0017dd75bb5abc60e244465d37a15abb133
-
Filesize
7.4MB
MD5443df84258f3cc21efb5ad185ed2fe4f
SHA122dc3b0c04ff55dca5a93856a1ff30cea6e5e7e8
SHA256b982252fef5780ca193d07fb2754f721ef7869c2d583a09217b8d3c1e6d2ef49
SHA5121e82a58c1ea297f761d4e1f85f45d16aa91d71bddc9df539c5e19e04f714f19353258337d6640b3c9bc51a77ed4fc2bffd0aa40102ec69eb30b01af859c5a1e0
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
192KB
-
Filesize
20KB
-
Filesize
152KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
256KB
-
Filesize
88KB
-
Filesize
8KB