Analysis
-
max time kernel
133s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-09-2022 14:41
Static task
static1
Behavioral task
behavioral1
Sample
URFT06GSBAWRP_001_PDF/RQK02HVBPO_002_PDF.vbs
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
URFT06GSBAWRP_001_PDF/RQK02HVBPO_002_PDF.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
URFT06GSBAWRP_001_PDF/URFT06GSBAWRP_001_PDF.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
URFT06GSBAWRP_001_PDF/URFT06GSBAWRP_001_PDF.exe
Resource
win10v2004-20220812-en
General
-
Target
URFT06GSBAWRP_001_PDF/URFT06GSBAWRP_001_PDF.exe
-
Size
300.0MB
-
MD5
464753cd8a6523de0fba921ce6846177
-
SHA1
6b3b77af1129f9ad86acc31163d8450eacb4dbd3
-
SHA256
3221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092
-
SHA512
589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2
-
SSDEEP
3072:1iJZ3k2p8jrvVIYkwur2JMBZ6kINhCRFuaABOUEs64BRg40nOFblHTgr4:1OyRr9u1KJkZ6dIYBUeBRgOlWU
Malware Config
Extracted
asyncrat
Venom RAT 5.0.5
Venom Clients
resulttoday2.duckdns.org:6111
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 8 IoCs
Processes:
resource yara_rule behavioral3/memory/540-62-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat behavioral3/memory/540-63-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat behavioral3/memory/540-64-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat behavioral3/memory/540-65-0x00000000004109DE-mapping.dmp asyncrat behavioral3/memory/540-69-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat behavioral3/memory/540-67-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat behavioral3/memory/1916-85-0x00000000004109DE-mapping.dmp asyncrat behavioral3/memory/284-104-0x00000000004109DE-mapping.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
opetr.exeopetr.exepid process 1364 opetr.exe 1976 opetr.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
URFT06GSBAWRP_001_PDF.exeopetr.exeopetr.exedescription pid process target process PID 1468 set thread context of 540 1468 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1364 set thread context of 1916 1364 opetr.exe vbc.exe PID 1976 set thread context of 284 1976 opetr.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1064 schtasks.exe 756 schtasks.exe 1572 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vbc.exevbc.exevbc.exedescription pid process Token: SeDebugPrivilege 540 vbc.exe Token: SeDebugPrivilege 1916 vbc.exe Token: SeDebugPrivilege 284 vbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
URFT06GSBAWRP_001_PDF.execmd.exetaskeng.exeopetr.execmd.exeopetr.execmd.exedescription pid process target process PID 1468 wrote to memory of 1684 1468 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1468 wrote to memory of 1684 1468 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1468 wrote to memory of 1684 1468 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1468 wrote to memory of 1684 1468 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1684 wrote to memory of 1064 1684 cmd.exe schtasks.exe PID 1684 wrote to memory of 1064 1684 cmd.exe schtasks.exe PID 1684 wrote to memory of 1064 1684 cmd.exe schtasks.exe PID 1684 wrote to memory of 1064 1684 cmd.exe schtasks.exe PID 1468 wrote to memory of 1276 1468 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1468 wrote to memory of 1276 1468 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1468 wrote to memory of 1276 1468 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1468 wrote to memory of 1276 1468 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1468 wrote to memory of 540 1468 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1468 wrote to memory of 540 1468 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1468 wrote to memory of 540 1468 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1468 wrote to memory of 540 1468 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1468 wrote to memory of 540 1468 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1468 wrote to memory of 540 1468 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1468 wrote to memory of 540 1468 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1468 wrote to memory of 540 1468 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1468 wrote to memory of 540 1468 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1732 wrote to memory of 1364 1732 taskeng.exe opetr.exe PID 1732 wrote to memory of 1364 1732 taskeng.exe opetr.exe PID 1732 wrote to memory of 1364 1732 taskeng.exe opetr.exe PID 1732 wrote to memory of 1364 1732 taskeng.exe opetr.exe PID 1364 wrote to memory of 1600 1364 opetr.exe cmd.exe PID 1364 wrote to memory of 1600 1364 opetr.exe cmd.exe PID 1364 wrote to memory of 1600 1364 opetr.exe cmd.exe PID 1364 wrote to memory of 1600 1364 opetr.exe cmd.exe PID 1364 wrote to memory of 1220 1364 opetr.exe cmd.exe PID 1364 wrote to memory of 1220 1364 opetr.exe cmd.exe PID 1364 wrote to memory of 1220 1364 opetr.exe cmd.exe PID 1364 wrote to memory of 1220 1364 opetr.exe cmd.exe PID 1600 wrote to memory of 756 1600 cmd.exe schtasks.exe PID 1600 wrote to memory of 756 1600 cmd.exe schtasks.exe PID 1600 wrote to memory of 756 1600 cmd.exe schtasks.exe PID 1600 wrote to memory of 756 1600 cmd.exe schtasks.exe PID 1364 wrote to memory of 1916 1364 opetr.exe vbc.exe PID 1364 wrote to memory of 1916 1364 opetr.exe vbc.exe PID 1364 wrote to memory of 1916 1364 opetr.exe vbc.exe PID 1364 wrote to memory of 1916 1364 opetr.exe vbc.exe PID 1364 wrote to memory of 1916 1364 opetr.exe vbc.exe PID 1364 wrote to memory of 1916 1364 opetr.exe vbc.exe PID 1364 wrote to memory of 1916 1364 opetr.exe vbc.exe PID 1364 wrote to memory of 1916 1364 opetr.exe vbc.exe PID 1364 wrote to memory of 1916 1364 opetr.exe vbc.exe PID 1732 wrote to memory of 1976 1732 taskeng.exe opetr.exe PID 1732 wrote to memory of 1976 1732 taskeng.exe opetr.exe PID 1732 wrote to memory of 1976 1732 taskeng.exe opetr.exe PID 1732 wrote to memory of 1976 1732 taskeng.exe opetr.exe PID 1976 wrote to memory of 1620 1976 opetr.exe cmd.exe PID 1976 wrote to memory of 1620 1976 opetr.exe cmd.exe PID 1976 wrote to memory of 1620 1976 opetr.exe cmd.exe PID 1976 wrote to memory of 1620 1976 opetr.exe cmd.exe PID 1620 wrote to memory of 1572 1620 cmd.exe schtasks.exe PID 1620 wrote to memory of 1572 1620 cmd.exe schtasks.exe PID 1620 wrote to memory of 1572 1620 cmd.exe schtasks.exe PID 1620 wrote to memory of 1572 1620 cmd.exe schtasks.exe PID 1976 wrote to memory of 1352 1976 opetr.exe cmd.exe PID 1976 wrote to memory of 1352 1976 opetr.exe cmd.exe PID 1976 wrote to memory of 1352 1976 opetr.exe cmd.exe PID 1976 wrote to memory of 1352 1976 opetr.exe cmd.exe PID 1976 wrote to memory of 284 1976 opetr.exe vbc.exe PID 1976 wrote to memory of 284 1976 opetr.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF\URFT06GSBAWRP_001_PDF.exe"C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF\URFT06GSBAWRP_001_PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF\URFT06GSBAWRP_001_PDF.exe" "C:\Users\Admin\AppData\Roaming\opetr.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {56019283-6A09-4C33-B2F4-9620522016AA} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\opetr.exeC:\Users\Admin\AppData\Roaming\opetr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\opetr.exe" "C:\Users\Admin\AppData\Roaming\opetr.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\opetr.exeC:\Users\Admin\AppData\Roaming\opetr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\opetr.exe" "C:\Users\Admin\AppData\Roaming\opetr.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\opetr.exeFilesize
300.0MB
MD5464753cd8a6523de0fba921ce6846177
SHA16b3b77af1129f9ad86acc31163d8450eacb4dbd3
SHA2563221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092
SHA512589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2
-
C:\Users\Admin\AppData\Roaming\opetr.exeFilesize
300.0MB
MD5464753cd8a6523de0fba921ce6846177
SHA16b3b77af1129f9ad86acc31163d8450eacb4dbd3
SHA2563221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092
SHA512589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2
-
C:\Users\Admin\AppData\Roaming\opetr.exeFilesize
300.0MB
MD5464753cd8a6523de0fba921ce6846177
SHA16b3b77af1129f9ad86acc31163d8450eacb4dbd3
SHA2563221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092
SHA512589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2
-
memory/284-104-0x00000000004109DE-mapping.dmp
-
memory/540-67-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/540-59-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/540-60-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/540-62-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/540-63-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/540-64-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/540-65-0x00000000004109DE-mapping.dmp
-
memory/540-69-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/756-78-0x0000000000000000-mapping.dmp
-
memory/1064-57-0x0000000000000000-mapping.dmp
-
memory/1220-77-0x0000000000000000-mapping.dmp
-
memory/1276-58-0x0000000000000000-mapping.dmp
-
memory/1352-97-0x0000000000000000-mapping.dmp
-
memory/1364-71-0x0000000000000000-mapping.dmp
-
memory/1364-73-0x0000000000210000-0x0000000000242000-memory.dmpFilesize
200KB
-
memory/1468-54-0x0000000000E80000-0x0000000000EB2000-memory.dmpFilesize
200KB
-
memory/1468-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/1572-96-0x0000000000000000-mapping.dmp
-
memory/1600-76-0x0000000000000000-mapping.dmp
-
memory/1620-95-0x0000000000000000-mapping.dmp
-
memory/1684-56-0x0000000000000000-mapping.dmp
-
memory/1916-85-0x00000000004109DE-mapping.dmp
-
memory/1976-91-0x0000000000000000-mapping.dmp
-
memory/1976-93-0x0000000000E00000-0x0000000000E32000-memory.dmpFilesize
200KB