Analysis

  • max time kernel
    129s
  • max time network
    139s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    02-03-2021 21:46

General

  • Target

    73b5932f1556db5d2532888b72127b3c707315f0785edd14fd6bb519c8e55064.exe

  • Size

    534KB

  • MD5

    2e89910089adeb48e11a364e3a0dfcfc

  • SHA1

    66763d2d596468f40728731b1f9ab072d573a275

  • SHA256

    73b5932f1556db5d2532888b72127b3c707315f0785edd14fd6bb519c8e55064

  • SHA512

    8aa3c9cae7db6f1f3dc688f011eb85cfbbaf250f36e38ffcd84408ffa35b1f0700fe64991ac39b67ead97edf595fd632232944b28ae29cacd2aef176397d8278

Malware Config

Signatures

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\73b5932f1556db5d2532888b72127b3c707315f0785edd14fd6bb519c8e55064.exe
    "C:\Users\Admin\AppData\Local\Temp\73b5932f1556db5d2532888b72127b3c707315f0785edd14fd6bb519c8e55064.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4712-2-0x00000000735D0000-0x0000000073CBE000-memory.dmp

    Filesize

    6.9MB

  • memory/4712-3-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

    Filesize

    4KB

  • memory/4712-5-0x0000000005F20000-0x0000000005F21000-memory.dmp

    Filesize

    4KB

  • memory/4712-6-0x0000000005900000-0x0000000005901000-memory.dmp

    Filesize

    4KB

  • memory/4712-7-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

    Filesize

    4KB

  • memory/4712-8-0x00000000059A0000-0x00000000059A1000-memory.dmp

    Filesize

    4KB

  • memory/4712-9-0x0000000006620000-0x0000000006621000-memory.dmp

    Filesize

    4KB

  • memory/4712-10-0x0000000006A10000-0x0000000006A11000-memory.dmp

    Filesize

    4KB

  • memory/4712-11-0x0000000006D80000-0x0000000006D81000-memory.dmp

    Filesize

    4KB