Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 15:01
General
- Target Tax_Notice_36758.exe
- Size 287KB
- Sample260709-sdvz9scw2m
- SHA256 93694473622f770d539263ae211dde4715264b0f23c858ba69796adca76cae35
Malware Config
Extracted
-
asyncrat
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
-
Default
-
192.252.180.45:4449
-
jsatnrumqsvfenqdgep
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
- Async RAT payload 1 IoCs
- VenomRAT 1 IoCs
Detects VenomRAT.
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tax_Notice_36758.exe"C:\Users\Admin\AppData\Local\Temp\Tax_Notice_36758.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RuntimeBroker\RuntimeBroker.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RuntimeBroker\RuntimeBroker.exe1⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RuntimeBroker.exe
nvml.dll
DataLogs.conf
memory/468-18-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/468-27-0x00007FFDC7340000-0x00007FFDC7381000-memory.dmp
memory/468-6-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/468-2-0x00000000021C0000-0x00000000021D8000-memory.dmp
memory/468-1-0x00007FFDB568F000-0x00007FFDB5690000-memory.dmp
memory/468-10-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/468-11-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/468-12-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/468-13-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/468-14-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/468-15-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/468-16-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/468-17-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/468-0-0x00000000004C0000-0x00000000004DC000-memory.dmp
memory/468-4-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/468-28-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/468-19-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/2764-31-0x00007FFDC1710000-0x00007FFDC1751000-memory.dmp
memory/2764-34-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/2764-24-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/2764-25-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/2764-26-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/2764-22-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/2764-30-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/2764-29-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/2764-20-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/2764-21-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/2764-32-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/2764-33-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/2764-23-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp
memory/2764-35-0x00007FFDB5500000-0x00007FFDB5EA4000-memory.dmp