Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-09-2022 14:41
Static task
static1
Behavioral task
behavioral1
Sample
URFT06GSBAWRP_001_PDF/RQK02HVBPO_002_PDF.vbs
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
URFT06GSBAWRP_001_PDF/RQK02HVBPO_002_PDF.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
URFT06GSBAWRP_001_PDF/URFT06GSBAWRP_001_PDF.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
URFT06GSBAWRP_001_PDF/URFT06GSBAWRP_001_PDF.exe
Resource
win10v2004-20220812-en
General
-
Target
URFT06GSBAWRP_001_PDF/URFT06GSBAWRP_001_PDF.exe
-
Size
300.0MB
-
MD5
464753cd8a6523de0fba921ce6846177
-
SHA1
6b3b77af1129f9ad86acc31163d8450eacb4dbd3
-
SHA256
3221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092
-
SHA512
589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2
-
SSDEEP
3072:1iJZ3k2p8jrvVIYkwur2JMBZ6kINhCRFuaABOUEs64BRg40nOFblHTgr4:1OyRr9u1KJkZ6dIYBUeBRgOlWU
Malware Config
Extracted
asyncrat
Venom RAT 5.0.5
Venom Clients
resulttoday2.duckdns.org:6111
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/4392-139-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
opetr.exepid process 3304 opetr.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
URFT06GSBAWRP_001_PDF.exeopetr.exedescription pid process target process PID 2304 set thread context of 4392 2304 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 3304 set thread context of 4408 3304 opetr.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3428 schtasks.exe 3460 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exevbc.exedescription pid process Token: SeDebugPrivilege 4392 vbc.exe Token: SeDebugPrivilege 4408 vbc.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
URFT06GSBAWRP_001_PDF.execmd.exeopetr.execmd.exedescription pid process target process PID 2304 wrote to memory of 1244 2304 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 2304 wrote to memory of 1244 2304 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 2304 wrote to memory of 1244 2304 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1244 wrote to memory of 3428 1244 cmd.exe schtasks.exe PID 1244 wrote to memory of 3428 1244 cmd.exe schtasks.exe PID 1244 wrote to memory of 3428 1244 cmd.exe schtasks.exe PID 2304 wrote to memory of 3572 2304 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 2304 wrote to memory of 3572 2304 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 2304 wrote to memory of 3572 2304 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 2304 wrote to memory of 4392 2304 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 2304 wrote to memory of 4392 2304 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 2304 wrote to memory of 4392 2304 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 2304 wrote to memory of 4392 2304 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 2304 wrote to memory of 4392 2304 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 2304 wrote to memory of 4392 2304 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 2304 wrote to memory of 4392 2304 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 2304 wrote to memory of 4392 2304 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 3304 wrote to memory of 2136 3304 opetr.exe cmd.exe PID 3304 wrote to memory of 2136 3304 opetr.exe cmd.exe PID 3304 wrote to memory of 2136 3304 opetr.exe cmd.exe PID 3304 wrote to memory of 1892 3304 opetr.exe cmd.exe PID 3304 wrote to memory of 1892 3304 opetr.exe cmd.exe PID 3304 wrote to memory of 1892 3304 opetr.exe cmd.exe PID 3304 wrote to memory of 4408 3304 opetr.exe vbc.exe PID 3304 wrote to memory of 4408 3304 opetr.exe vbc.exe PID 3304 wrote to memory of 4408 3304 opetr.exe vbc.exe PID 3304 wrote to memory of 4408 3304 opetr.exe vbc.exe PID 3304 wrote to memory of 4408 3304 opetr.exe vbc.exe PID 3304 wrote to memory of 4408 3304 opetr.exe vbc.exe PID 3304 wrote to memory of 4408 3304 opetr.exe vbc.exe PID 3304 wrote to memory of 4408 3304 opetr.exe vbc.exe PID 2136 wrote to memory of 3460 2136 cmd.exe schtasks.exe PID 2136 wrote to memory of 3460 2136 cmd.exe schtasks.exe PID 2136 wrote to memory of 3460 2136 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF\URFT06GSBAWRP_001_PDF.exe"C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF\URFT06GSBAWRP_001_PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF\URFT06GSBAWRP_001_PDF.exe" "C:\Users\Admin\AppData\Roaming\opetr.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\opetr.exeC:\Users\Admin\AppData\Roaming\opetr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\opetr.exe" "C:\Users\Admin\AppData\Roaming\opetr.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\opetr.exeFilesize
300.0MB
MD5464753cd8a6523de0fba921ce6846177
SHA16b3b77af1129f9ad86acc31163d8450eacb4dbd3
SHA2563221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092
SHA512589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2
-
C:\Users\Admin\AppData\Roaming\opetr.exeFilesize
300.0MB
MD5464753cd8a6523de0fba921ce6846177
SHA16b3b77af1129f9ad86acc31163d8450eacb4dbd3
SHA2563221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092
SHA512589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2
-
memory/1244-134-0x0000000000000000-mapping.dmp
-
memory/1892-147-0x0000000000000000-mapping.dmp
-
memory/2136-146-0x0000000000000000-mapping.dmp
-
memory/2304-136-0x0000000005A80000-0x0000000006024000-memory.dmpFilesize
5.6MB
-
memory/2304-132-0x0000000000810000-0x0000000000842000-memory.dmpFilesize
200KB
-
memory/2304-133-0x0000000005460000-0x00000000054C6000-memory.dmpFilesize
408KB
-
memory/3428-135-0x0000000000000000-mapping.dmp
-
memory/3460-150-0x0000000000000000-mapping.dmp
-
memory/3572-137-0x0000000000000000-mapping.dmp
-
memory/4392-138-0x0000000000000000-mapping.dmp
-
memory/4392-139-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/4392-140-0x00000000061B0000-0x000000000624C000-memory.dmpFilesize
624KB
-
memory/4392-141-0x00000000071B0000-0x0000000007226000-memory.dmpFilesize
472KB
-
memory/4392-142-0x0000000007150000-0x000000000716E000-memory.dmpFilesize
120KB
-
memory/4392-143-0x0000000007520000-0x00000000075B2000-memory.dmpFilesize
584KB
-
memory/4408-148-0x0000000000000000-mapping.dmp