Analysis

  • max time kernel
    131s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-02-2023 14:26

General

  • Target

    VenomRAT/VenomRAT_HVNC.exe.xml

  • Size

    2KB

  • MD5

    fa21c166232c3b29f8d2d14557490c9c

  • SHA1

    2cb1a7d4a204fc03bd6bd15aa9f431f3445a08de

  • SHA256

    5c939c46f9d81cb75180c897feb5044176ed44cd0d51e076149bd82425e4ef44

  • SHA512

    cca1dd276a093b62845e5a7652e778d07200b7158cb05a2b44e11e69ce8bc78020eeeb29d55a87a6b87a3fcc25b2883175850467002388a811abfe9945d58fd9

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\VenomRAT\VenomRAT_HVNC.exe.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3864
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\VenomRAT\VenomRAT_HVNC.exe.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3560
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3560 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1372

Network

  • flag-us
    DNS
    240.232.18.117.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.232.18.117.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    199.176.139.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    199.176.139.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    64.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    64.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.232.18.117.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.232.18.117.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    64.13.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    64.13.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    29.220.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    29.220.184.93.in-addr.arpa
    IN PTR
    Response
  • 20.189.173.5:443
    322 B
    7
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls, http2
    iexplore.exe
    1.2kB
    8.1kB
    15
    14
  • 117.18.237.29:80
    322 B
    7
  • 8.238.178.254:80
    322 B
    7
  • 8.238.178.254:80
    322 B
    7
  • 173.223.113.164:443
    322 B
    7
  • 173.223.113.131:80
    322 B
    7
  • 204.79.197.203:80
    322 B
    7
  • 117.18.232.240:80
    46 B
    1
  • 8.8.8.8:53
    240.232.18.117.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    240.232.18.117.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
    199.176.139.52.in-addr.arpa
    dns
    73 B
    159 B
    1
    1

    DNS Request

    199.176.139.52.in-addr.arpa

  • 8.8.8.8:53
    64.159.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    64.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    200.232.18.117.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    200.232.18.117.in-addr.arpa

  • 8.8.8.8:53
    64.13.109.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    64.13.109.52.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
    106 B
    1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    29.220.184.93.in-addr.arpa
    dns
    72 B
    143 B
    1
    1

    DNS Request

    29.220.184.93.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8OI4IV75\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • memory/3864-133-0x00007FFED7430000-0x00007FFED7440000-memory.dmp

    Filesize

    64KB

  • memory/3864-135-0x00007FFED7430000-0x00007FFED7440000-memory.dmp

    Filesize

    64KB

  • memory/3864-134-0x00007FFED7430000-0x00007FFED7440000-memory.dmp

    Filesize

    64KB

  • memory/3864-136-0x00007FFED7430000-0x00007FFED7440000-memory.dmp

    Filesize

    64KB

  • memory/3864-137-0x00007FFED7430000-0x00007FFED7440000-memory.dmp

    Filesize

    64KB

  • memory/3864-138-0x00007FFED7430000-0x00007FFED7440000-memory.dmp

    Filesize

    64KB

  • memory/3864-139-0x00007FFED7430000-0x00007FFED7440000-memory.dmp

    Filesize

    64KB

  • memory/3864-140-0x00007FFED7430000-0x00007FFED7440000-memory.dmp

    Filesize

    64KB

  • memory/3864-141-0x00007FFED7430000-0x00007FFED7440000-memory.dmp

    Filesize

    64KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.