Overview

overview

10

Static

static

10

b603bb5bf0...cd.exe

windows7_x64

10

b603bb5bf0...cd.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd

  • Size

    695KB

  • Sample

    210228-wq1rjc8g1a

  • MD5

    75a0dff08308ea7de7a5a7a0528683de

  • SHA1

    79fbffc4c4b90d58ea179ece6153302e8dd4012d

  • SHA256

    b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd

  • SHA512

    2cd661e50aad22c1d2b113dbe0e92f5391bc370fc19b8adf2009431a2dfd48072bf15a65edf6089c562ffeabee4c8fc0ab556448cef7a0ea72b007bd0df9708c

Score
10/10
venomratxmrigevasionminerpersistenceratrootkitstealer

Malware Config

Targets

    • Target

      b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd

    • Size

      695KB

    • MD5

      75a0dff08308ea7de7a5a7a0528683de

    • SHA1

      79fbffc4c4b90d58ea179ece6153302e8dd4012d

    • SHA256

      b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd

    • SHA512

      2cd661e50aad22c1d2b113dbe0e92f5391bc370fc19b8adf2009431a2dfd48072bf15a65edf6089c562ffeabee4c8fc0ab556448cef7a0ea72b007bd0df9708c

    Score
    10/10
    venomratxmrigevasionminerpersistenceratrootkitstealer

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • VenomRAT

      VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

      ratrootkitstealervenomrat

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks