asyncrat | 35195c489db28ef0062c2f87918bfebb2b49324dc1bc428b72abb6fb003f5aa7

General

Target

Client.exe
Size

74KB
MD5

ca869fce5d4ea896845c9faf30777df7
SHA1

23d7c3ed8b2d961b0c43c9dc09688f5f5c2412a0
SHA256

35195c489db28ef0062c2f87918bfebb2b49324dc1bc428b72abb6fb003f5aa7
SHA512

103f93419955fbb3401409b2109d59316c0f4e2d3ba474501d91d4f3b3feaef68fc770e97274663f1e904870a7e3d77515c6d8f43bcf3b27b4510b2a419cb1c9
SSDEEP

1536:8UUPcxVteCW7PMVee9VdQuDI6H1bf/Eq14bTzQzcBLVclN:8UmcxV4x7PMVee9VdQsH1bf/0QYBY

Score

10^/10

asyncrat venomrat default defense_evasion discovery rat trojan

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

132.145.75.68:5450

Mutex

nbonbvmijrwjbil

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	Client.exe

VenomRAT 1 IoCs

Detects VenomRAT.

rat

resource	yara_rule
behavioral2/memory/5316-1-0x0000000000520000-0x0000000000538000-memory.dmp	VenomRAT

Venomrat family
venomrat
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	Client.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua	Client.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe
5316	Client.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5316	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5316	Client.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	Client.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:5316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5316-1-0x0000000000520000-0x0000000000538000-memory.dmp

Filesize
96KB

Download
memory/5316-0-0x00007FFD57703000-0x00007FFD57705000-memory.dmp

Filesize
8KB

Download
memory/5316-3-0x00007FFD57700000-0x00007FFD581C1000-memory.dmp

Filesize
10.8MB

Download
memory/5316-4-0x00007FFD57700000-0x00007FFD581C1000-memory.dmp

Filesize
10.8MB

Download
memory/5316-9-0x00007FFD57700000-0x00007FFD581C1000-memory.dmp

Filesize
10.8MB

Download
memory/5316-7-0x00007FFD57700000-0x00007FFD581C1000-memory.dmp

Filesize
10.8MB

Download
memory/5316-11-0x000000001B1A0000-0x000000001B1AE000-memory.dmp

Filesize
56KB

Download
memory/5316-12-0x000000001B370000-0x000000001B38E000-memory.dmp

Filesize
120KB

Download
memory/5316-10-0x000000001C480000-0x000000001C4F6000-memory.dmp

Filesize
472KB

Download
memory/5316-13-0x000000001C400000-0x000000001C466000-memory.dmp

Filesize
408KB

Download
memory/5316-14-0x00007FFD57703000-0x00007FFD57705000-memory.dmp

Filesize
8KB

Download
memory/5316-15-0x00007FFD57700000-0x00007FFD581C1000-memory.dmp

Filesize
10.8MB

Download
memory/5316-16-0x00007FFD57700000-0x00007FFD581C1000-memory.dmp

Filesize
10.8MB

Download
memory/5316-17-0x00007FFD57700000-0x00007FFD581C1000-memory.dmp

Filesize
10.8MB

Download
memory/5316-18-0x00007FFD57700000-0x00007FFD581C1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads