Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-10-2022 11:08
Static task
static1
Behavioral task
behavioral1
Sample
1.msi
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1.msi
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
URFT06GSBAWRP_001_PDF.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
URFT06GSBAWRP_001_PDF.exe
Resource
win10v2004-20220812-en
General
-
Target
URFT06GSBAWRP_001_PDF.exe
-
Size
300.0MB
-
MD5
464753cd8a6523de0fba921ce6846177
-
SHA1
6b3b77af1129f9ad86acc31163d8450eacb4dbd3
-
SHA256
3221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092
-
SHA512
589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2
-
SSDEEP
3072:1iJZ3k2p8jrvVIYkwur2JMBZ6kINhCRFuaABOUEs64BRg40nOFblHTgr4:1OyRr9u1KJkZ6dIYBUeBRgOlWU
Malware Config
Extracted
asyncrat
Venom RAT 5.0.5
Venom Clients
resulttoday2.duckdns.org:6111
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 11 IoCs
Processes:
resource yara_rule behavioral3/memory/1624-62-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat behavioral3/memory/1624-63-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat behavioral3/memory/1624-64-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat behavioral3/memory/1624-65-0x00000000004109DE-mapping.dmp asyncrat behavioral3/memory/1624-67-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat behavioral3/memory/1624-69-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat behavioral3/memory/1908-85-0x00000000004109DE-mapping.dmp asyncrat behavioral3/memory/1908-87-0x0000000000080000-0x0000000000096000-memory.dmp asyncrat behavioral3/memory/1908-91-0x0000000000080000-0x0000000000096000-memory.dmp asyncrat behavioral3/memory/1908-94-0x0000000000080000-0x0000000000096000-memory.dmp asyncrat behavioral3/memory/1812-108-0x00000000004109DE-mapping.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
opetr.exeopetr.exepid process 1780 opetr.exe 1164 opetr.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
URFT06GSBAWRP_001_PDF.exeopetr.exeopetr.exedescription pid process target process PID 1112 set thread context of 1624 1112 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1780 set thread context of 1908 1780 opetr.exe vbc.exe PID 1164 set thread context of 1812 1164 opetr.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1056 schtasks.exe 1008 schtasks.exe 844 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vbc.exevbc.exevbc.exedescription pid process Token: SeDebugPrivilege 1624 vbc.exe Token: SeDebugPrivilege 1908 vbc.exe Token: SeDebugPrivilege 1812 vbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
URFT06GSBAWRP_001_PDF.execmd.exetaskeng.exeopetr.execmd.exeopetr.execmd.exedescription pid process target process PID 1112 wrote to memory of 628 1112 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1112 wrote to memory of 628 1112 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1112 wrote to memory of 628 1112 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1112 wrote to memory of 628 1112 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 628 wrote to memory of 1056 628 cmd.exe schtasks.exe PID 628 wrote to memory of 1056 628 cmd.exe schtasks.exe PID 628 wrote to memory of 1056 628 cmd.exe schtasks.exe PID 628 wrote to memory of 1056 628 cmd.exe schtasks.exe PID 1112 wrote to memory of 1000 1112 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1112 wrote to memory of 1000 1112 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1112 wrote to memory of 1000 1112 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1112 wrote to memory of 1000 1112 URFT06GSBAWRP_001_PDF.exe cmd.exe PID 1112 wrote to memory of 1624 1112 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1112 wrote to memory of 1624 1112 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1112 wrote to memory of 1624 1112 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1112 wrote to memory of 1624 1112 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1112 wrote to memory of 1624 1112 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1112 wrote to memory of 1624 1112 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1112 wrote to memory of 1624 1112 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1112 wrote to memory of 1624 1112 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1112 wrote to memory of 1624 1112 URFT06GSBAWRP_001_PDF.exe vbc.exe PID 1292 wrote to memory of 1780 1292 taskeng.exe opetr.exe PID 1292 wrote to memory of 1780 1292 taskeng.exe opetr.exe PID 1292 wrote to memory of 1780 1292 taskeng.exe opetr.exe PID 1292 wrote to memory of 1780 1292 taskeng.exe opetr.exe PID 1780 wrote to memory of 964 1780 opetr.exe cmd.exe PID 1780 wrote to memory of 964 1780 opetr.exe cmd.exe PID 1780 wrote to memory of 964 1780 opetr.exe cmd.exe PID 1780 wrote to memory of 964 1780 opetr.exe cmd.exe PID 1780 wrote to memory of 1452 1780 opetr.exe cmd.exe PID 1780 wrote to memory of 1452 1780 opetr.exe cmd.exe PID 1780 wrote to memory of 1452 1780 opetr.exe cmd.exe PID 1780 wrote to memory of 1452 1780 opetr.exe cmd.exe PID 964 wrote to memory of 1008 964 cmd.exe schtasks.exe PID 964 wrote to memory of 1008 964 cmd.exe schtasks.exe PID 964 wrote to memory of 1008 964 cmd.exe schtasks.exe PID 964 wrote to memory of 1008 964 cmd.exe schtasks.exe PID 1780 wrote to memory of 1908 1780 opetr.exe vbc.exe PID 1780 wrote to memory of 1908 1780 opetr.exe vbc.exe PID 1780 wrote to memory of 1908 1780 opetr.exe vbc.exe PID 1780 wrote to memory of 1908 1780 opetr.exe vbc.exe PID 1780 wrote to memory of 1908 1780 opetr.exe vbc.exe PID 1780 wrote to memory of 1908 1780 opetr.exe vbc.exe PID 1780 wrote to memory of 1908 1780 opetr.exe vbc.exe PID 1780 wrote to memory of 1908 1780 opetr.exe vbc.exe PID 1780 wrote to memory of 1908 1780 opetr.exe vbc.exe PID 1292 wrote to memory of 1164 1292 taskeng.exe opetr.exe PID 1292 wrote to memory of 1164 1292 taskeng.exe opetr.exe PID 1292 wrote to memory of 1164 1292 taskeng.exe opetr.exe PID 1292 wrote to memory of 1164 1292 taskeng.exe opetr.exe PID 1164 wrote to memory of 304 1164 opetr.exe cmd.exe PID 1164 wrote to memory of 304 1164 opetr.exe cmd.exe PID 1164 wrote to memory of 304 1164 opetr.exe cmd.exe PID 1164 wrote to memory of 304 1164 opetr.exe cmd.exe PID 304 wrote to memory of 844 304 cmd.exe schtasks.exe PID 304 wrote to memory of 844 304 cmd.exe schtasks.exe PID 304 wrote to memory of 844 304 cmd.exe schtasks.exe PID 304 wrote to memory of 844 304 cmd.exe schtasks.exe PID 1164 wrote to memory of 280 1164 opetr.exe cmd.exe PID 1164 wrote to memory of 280 1164 opetr.exe cmd.exe PID 1164 wrote to memory of 280 1164 opetr.exe cmd.exe PID 1164 wrote to memory of 280 1164 opetr.exe cmd.exe PID 1164 wrote to memory of 1812 1164 opetr.exe vbc.exe PID 1164 wrote to memory of 1812 1164 opetr.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF.exe"C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF.exe" "C:\Users\Admin\AppData\Roaming\opetr.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {C915641F-A65D-42BE-BFCB-D4FAA910CD1B} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\opetr.exeC:\Users\Admin\AppData\Roaming\opetr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\opetr.exe" "C:\Users\Admin\AppData\Roaming\opetr.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\opetr.exeC:\Users\Admin\AppData\Roaming\opetr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\opetr.exe" "C:\Users\Admin\AppData\Roaming\opetr.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\opetr.exeFilesize
300.0MB
MD5464753cd8a6523de0fba921ce6846177
SHA16b3b77af1129f9ad86acc31163d8450eacb4dbd3
SHA2563221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092
SHA512589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2
-
C:\Users\Admin\AppData\Roaming\opetr.exeFilesize
300.0MB
MD5464753cd8a6523de0fba921ce6846177
SHA16b3b77af1129f9ad86acc31163d8450eacb4dbd3
SHA2563221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092
SHA512589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2
-
C:\Users\Admin\AppData\Roaming\opetr.exeFilesize
300.0MB
MD5464753cd8a6523de0fba921ce6846177
SHA16b3b77af1129f9ad86acc31163d8450eacb4dbd3
SHA2563221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092
SHA512589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2
-
memory/280-101-0x0000000000000000-mapping.dmp
-
memory/304-99-0x0000000000000000-mapping.dmp
-
memory/628-56-0x0000000000000000-mapping.dmp
-
memory/844-100-0x0000000000000000-mapping.dmp
-
memory/964-76-0x0000000000000000-mapping.dmp
-
memory/1000-58-0x0000000000000000-mapping.dmp
-
memory/1008-78-0x0000000000000000-mapping.dmp
-
memory/1056-57-0x0000000000000000-mapping.dmp
-
memory/1112-54-0x0000000000F40000-0x0000000000F72000-memory.dmpFilesize
200KB
-
memory/1112-55-0x0000000075351000-0x0000000075353000-memory.dmpFilesize
8KB
-
memory/1164-96-0x0000000000000000-mapping.dmp
-
memory/1452-77-0x0000000000000000-mapping.dmp
-
memory/1624-62-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1624-64-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1624-59-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1624-69-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1624-67-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1624-60-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1624-63-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1624-65-0x00000000004109DE-mapping.dmp
-
memory/1780-74-0x0000000000E70000-0x0000000000EA2000-memory.dmpFilesize
200KB
-
memory/1780-72-0x0000000000000000-mapping.dmp
-
memory/1812-108-0x00000000004109DE-mapping.dmp
-
memory/1908-94-0x0000000000080000-0x0000000000096000-memory.dmpFilesize
88KB
-
memory/1908-91-0x0000000000080000-0x0000000000096000-memory.dmpFilesize
88KB
-
memory/1908-87-0x0000000000080000-0x0000000000096000-memory.dmpFilesize
88KB
-
memory/1908-85-0x00000000004109DE-mapping.dmp