Analysis
- max time kernel
28s - max time network
144s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
- submitted
09/01/2023, 12:31
General
- Target 98bb7310f473f8151d19643afb9142c0.exe
- Size 915KB
- Sample230109-pp2qeahe91
- SHA256 b77a024602ae648ad80a3fd49f08a26b99c377b81b189b60f474437ab13205b4
Malware Config
Extracted
-
asyncrat
-
VenomRAT+HVNC+Stealer Version:5.0.9
-
Venom Clients
-
185.132.176.192:4449
-
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Async RAT payload 4 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application 2 TTPs 1 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\98bb7310f473f8151d19643afb9142c0.exe"C:\Users\Admin\AppData\Local\Temp\98bb7310f473f8151d19643afb9142c0.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1512-56-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1512-61-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1512-59-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1512-62-0x00000000753D1000-0x00000000753D3000-memory.dmp
memory/1512-63-0x0000000006100000-0x0000000006222000-memory.dmp
memory/1996-54-0x0000000000E40000-0x0000000000F2A000-memory.dmp
memory/1996-55-0x0000000000C20000-0x0000000000C76000-memory.dmp