Analysis
-
max time kernel
145s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 16:27
Static task
static1
Behavioral task
behavioral1
Sample
877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779.exe
Resource
win10v2004-20220812-en
General
-
Target
877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779.exe
-
Size
986KB
-
MD5
9abed258d16bc74722d469f48baeccd5
-
SHA1
f2b2d18fbd0dd22b755aea5a4f9bc1e2148cac47
-
SHA256
877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779
-
SHA512
b1d6e7f308cc8587000c097c4d7693c8d501923e3f5b7dcfc6380d071b3372dccda66f8d6beff278dec09c42d9eee7c846c37bbc821d825d31321e6490403c2b
-
SSDEEP
12288:tPJ3fLJ8ACnT6u+kzJNolKRP1OS5+RYK4pzDfRtcg7C5dOdp5Swx7IkNP:BtWACT6uGlKhqmK4OgG5dmGw+mP
Malware Config
Extracted
asyncrat
Venom RAT 5.0.5
Venom Clients
80.89.230.176:4449
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
5
-
install
true
-
install_file
svshost.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4420-138-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
svshost.exepid process 2920 svshost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779.exedescription pid process target process PID 380 set thread context of 4420 380 877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779.exe RegSvcs.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4700 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
RegSvcs.exepid process 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe 4420 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 4420 RegSvcs.exe Token: SeDebugPrivilege 4420 RegSvcs.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779.exeRegSvcs.execmd.execmd.exedescription pid process target process PID 380 wrote to memory of 4420 380 877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779.exe RegSvcs.exe PID 380 wrote to memory of 4420 380 877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779.exe RegSvcs.exe PID 380 wrote to memory of 4420 380 877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779.exe RegSvcs.exe PID 380 wrote to memory of 4420 380 877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779.exe RegSvcs.exe PID 380 wrote to memory of 4420 380 877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779.exe RegSvcs.exe PID 380 wrote to memory of 4420 380 877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779.exe RegSvcs.exe PID 380 wrote to memory of 4420 380 877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779.exe RegSvcs.exe PID 380 wrote to memory of 4420 380 877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779.exe RegSvcs.exe PID 4420 wrote to memory of 8 4420 RegSvcs.exe cmd.exe PID 4420 wrote to memory of 8 4420 RegSvcs.exe cmd.exe PID 4420 wrote to memory of 8 4420 RegSvcs.exe cmd.exe PID 4420 wrote to memory of 664 4420 RegSvcs.exe cmd.exe PID 4420 wrote to memory of 664 4420 RegSvcs.exe cmd.exe PID 4420 wrote to memory of 664 4420 RegSvcs.exe cmd.exe PID 8 wrote to memory of 4868 8 cmd.exe schtasks.exe PID 8 wrote to memory of 4868 8 cmd.exe schtasks.exe PID 8 wrote to memory of 4868 8 cmd.exe schtasks.exe PID 664 wrote to memory of 4700 664 cmd.exe timeout.exe PID 664 wrote to memory of 4700 664 cmd.exe timeout.exe PID 664 wrote to memory of 4700 664 cmd.exe timeout.exe PID 664 wrote to memory of 2920 664 cmd.exe svshost.exe PID 664 wrote to memory of 2920 664 cmd.exe svshost.exe PID 664 wrote to memory of 2920 664 cmd.exe svshost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779.exe"C:\Users\Admin\AppData\Local\Temp\877e947467beb6827f5dec938c5c73e6b56d632a9422c4b4f4bef83cd19c0779.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svshost" /tr '"C:\Users\Admin\AppData\Roaming\svshost.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svshost" /tr '"C:\Users\Admin\AppData\Roaming\svshost.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6532.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svshost.exe"C:\Users\Admin\AppData\Roaming\svshost.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6532.tmp.batFilesize
151B
MD54407c90c8ba6a316b0633a8f08fb7d66
SHA1cee1417c847907ca850db79249a2657176105b5e
SHA2566379591cfa136f7afa0923c72d9875864996b27a05e4370c115ea09f503b9ff3
SHA5124079fca1ab63fb4afe1573c0f006a50c2e0647f904926eabdc1748fbbf715b49e53ff92e8c11dabb785947e815ad7a416d77d7441d371437ea6d40567801416a
-
C:\Users\Admin\AppData\Roaming\svshost.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\svshost.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
memory/8-139-0x0000000000000000-mapping.dmp
-
memory/380-136-0x0000000004CB0000-0x0000000004CBA000-memory.dmpFilesize
40KB
-
memory/380-132-0x0000000000200000-0x00000000002FC000-memory.dmpFilesize
1008KB
-
memory/380-135-0x0000000004DC0000-0x0000000004E5C000-memory.dmpFilesize
624KB
-
memory/380-134-0x0000000004D20000-0x0000000004DB2000-memory.dmpFilesize
584KB
-
memory/380-133-0x0000000005230000-0x00000000057D4000-memory.dmpFilesize
5.6MB
-
memory/664-140-0x0000000000000000-mapping.dmp
-
memory/2920-144-0x0000000000000000-mapping.dmp
-
memory/2920-147-0x00000000001A0000-0x00000000001AE000-memory.dmpFilesize
56KB
-
memory/2920-148-0x0000000004940000-0x000000000497C000-memory.dmpFilesize
240KB
-
memory/4420-137-0x0000000000000000-mapping.dmp
-
memory/4420-138-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/4700-143-0x0000000000000000-mapping.dmp
-
memory/4868-141-0x0000000000000000-mapping.dmp