Analysis
- max time kernel
150s - max time network
142s - platform
windows10_x64 - resource
win10 - submitted
15/08/2020, 22:47
General
- Target 77-Venom.exe
- Size 576KB
- Sample200815-r64bjdd2ae
- SHA256 e83d13fcdc0f133482d558c8ce25b45a491ba3aff13849ce8169f05bb4972f0d
Malware Config
Extracted
-
quasar
-
2.1.0.0
-
Office04
-
178.33.23.183:60000
-
VNM_MUTEX_c2q7y2ayYutZ2XaYe7
-
encryption_key
EjSlCu0gcLJmleDu0lDT
-
install_name
Discord.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
-
subdirectory
SubDir
Extracted
-
orcus
-
2a03:75c0:27:cce0::1:587
-
db4b0e3c31bf4b41bf8b2ec94ff95c0f
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%LOCALAPPDATA%\Discord\Discord.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Discord
-
watchdog_path
AppData\Discord.exe
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings 3 TTPs
- Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
- Orcus Main Payload 5 IoCs
- Quasar Payload 2 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
- Orcurs Rat Executable 5 IoCs
- Executes dropped EXE 8 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 38 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\77-Venom.exe"C:\Users\Admin\AppData\Local\Temp\77-Venom.exe"1⤵
- Windows security modification
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\77-Venom.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\SubDir\Discord.exe"C:\Windows\SysWOW64\SubDir\Discord.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\Discord.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\cZDq9l15FiaD.exe"C:\Users\Admin\AppData\Local\Temp\cZDq9l15FiaD.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Discord\Discord.exe"C:\Users\Admin\AppData\Local\Discord\Discord.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Discord.exe"C:\Users\Admin\AppData\Roaming\Discord.exe" /launchSelfAndExit "C:\Users\Admin\AppData\Local\Discord\Discord.exe" 2120 /protectFile5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Discord.exe"C:\Users\Admin\AppData\Roaming\Discord.exe" /watchProcess "C:\Users\Admin\AppData\Local\Discord\Discord.exe" 2120 "/protectFile"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oyliKlt2eaG5.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
-
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Discord\Discord.exeC:\Users\Admin\AppData\Local\Discord\Discord.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/500-58-0x0000000000600000-0x0000000000601000-memory.dmp
memory/500-57-0x0000000073B80000-0x000000007426E000-memory.dmp
memory/500-60-0x0000000000D10000-0x0000000000D1C000-memory.dmp
memory/500-61-0x0000000004F60000-0x0000000004FBA000-memory.dmp
memory/500-66-0x0000000005AC0000-0x0000000005AC1000-memory.dmp
memory/500-65-0x0000000005090000-0x0000000005092000-memory.dmp
memory/500-64-0x0000000005080000-0x0000000005090000-memory.dmp
memory/1312-78-0x00007FFDD5BD0000-0x00007FFDD65BC000-memory.dmp
memory/1312-83-0x000000001B580000-0x000000001B581000-memory.dmp
memory/1552-102-0x0000000073B80000-0x000000007426E000-memory.dmp
memory/2120-101-0x0000000005800000-0x0000000005815000-memory.dmp
memory/2120-130-0x0000000007720000-0x0000000007721000-memory.dmp
memory/2120-129-0x00000000075B0000-0x00000000075B1000-memory.dmp
memory/2120-126-0x0000000007B00000-0x0000000007B01000-memory.dmp
memory/2120-104-0x0000000006190000-0x0000000006191000-memory.dmp
memory/2120-103-0x0000000005FB0000-0x0000000005FBC000-memory.dmp
memory/2120-98-0x0000000005780000-0x0000000005781000-memory.dmp
memory/2120-97-0x0000000005720000-0x0000000005768000-memory.dmp
memory/2120-87-0x0000000073B80000-0x000000007426E000-memory.dmp
memory/2800-113-0x0000000000A30000-0x0000000000A31000-memory.dmp
memory/2800-112-0x0000000073B80000-0x000000007426E000-memory.dmp
memory/3236-26-0x0000000007C60000-0x0000000007C61000-memory.dmp
memory/3236-34-0x0000000008BA0000-0x0000000008BD3000-memory.dmp
memory/3236-18-0x0000000073B80000-0x000000007426E000-memory.dmp
memory/3236-21-0x00000000069D0000-0x00000000069D1000-memory.dmp
memory/3236-43-0x0000000008E30000-0x0000000008E31000-memory.dmp
memory/3236-24-0x0000000007500000-0x0000000007501000-memory.dmp
memory/3236-42-0x0000000008CD0000-0x0000000008CD1000-memory.dmp
memory/3236-41-0x0000000008920000-0x0000000008921000-memory.dmp
memory/3236-46-0x0000000008DD0000-0x0000000008DD1000-memory.dmp
memory/3236-27-0x0000000007BB0000-0x0000000007BB1000-memory.dmp
memory/3236-20-0x0000000006B50000-0x0000000006B51000-memory.dmp
memory/3236-25-0x0000000007320000-0x0000000007321000-memory.dmp
memory/3236-19-0x00000000064E0000-0x00000000064E1000-memory.dmp
memory/3236-22-0x00000000071F0000-0x00000000071F1000-memory.dmp
memory/3236-44-0x0000000008DE0000-0x0000000008DE1000-memory.dmp
memory/3244-76-0x000000001AE40000-0x000000001AE41000-memory.dmp
memory/3244-75-0x0000000000B00000-0x0000000000B01000-memory.dmp
memory/3244-72-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/3244-71-0x00007FFDD5BD0000-0x00007FFDD65BC000-memory.dmp
memory/3500-32-0x00000000060D0000-0x00000000060D1000-memory.dmp
memory/3500-13-0x0000000073B80000-0x000000007426E000-memory.dmp
memory/3780-7-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3780-4-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
memory/3780-0-0x0000000073B80000-0x000000007426E000-memory.dmp
memory/3780-5-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/3780-3-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
memory/3780-1-0x00000000000B0000-0x00000000000B1000-memory.dmp
memory/3780-6-0x0000000005930000-0x0000000005931000-memory.dmp
memory/4076-123-0x0000000073B80000-0x000000007426E000-memory.dmp