Analysis
-
max time kernel
131s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
02-03-2021 23:31
General
-
Target
73b5932f1556db5d2532888b72127b3c707315f0785edd14fd6bb519c8e55064.exe
-
Size
534KB
-
MD5
2e89910089adeb48e11a364e3a0dfcfc
-
SHA1
66763d2d596468f40728731b1f9ab072d573a275
-
SHA256
73b5932f1556db5d2532888b72127b3c707315f0785edd14fd6bb519c8e55064
-
SHA512
8aa3c9cae7db6f1f3dc688f011eb85cfbbaf250f36e38ffcd84408ffa35b1f0700fe64991ac39b67ead97edf595fd632232944b28ae29cacd2aef176397d8278
Score
10/10
Malware Config
Signatures
-
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\73b5932f1556db5d2532888b72127b3c707315f0785edd14fd6bb519c8e55064.exe"C:\Users\Admin\AppData\Local\Temp\73b5932f1556db5d2532888b72127b3c707315f0785edd14fd6bb519c8e55064.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB