asyncrat | 25d3b2e90d875a39da06c8d8c6c24478947af5d193302269f1b08d4b298e7a90

Analysis

max time kernel
150s
max time network
125s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
18-03-2023 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Venom_RAT_5.6_[tombstone3#3883]/Venom_RAT_COMPILED/Venom RAT + HVNC.exe
Size

15.5MB
MD5

dc7afff0e35d307b937803c0c9ce9950
SHA1

25763c899b1e0f1d7073f287513338c2f52fd560
SHA256

91fd819114314284f960159ca85b160ff39a025c55cf51960bb5262878db97f5
SHA512

68e86c1e7b72c7592e3d6a911cfbc1339f9b638312ef59ae6b81bf733676813c3a6512f5d79c685e324cb0be7ae1ffafd72dd75a45116fb7c3762d78f797698b
SSDEEP

196608:UA5PPrnA5PPr3lAA5PPrJSe6PC7aIahLkNPFCZZwiJl1NLIsPA8fxvuIMzd/95Un:PebljNd60T7P+Zw6NLIsFfskh1BmXG

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/4452-120-0x0000013538AF0000-0x0000013539A82000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Venom RAT + HVNC.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Control Panel\International\Geo\Nation	Venom RAT + HVNC.exe

Loads dropped DLL 1 IoCs

Processes:

Venom RAT + HVNC.exe

pid process

4452 Venom RAT + HVNC.exe

Drops file in Windows directory 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 658c930b9259d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000070572264725849f9522122998562dea930cb453c260deb364fd358f2dddc263b39ace637197ad9a26a5c5a4a0cd19936131e6eb33b335876a500fa4c207445d574862498c10c517d7444e0353b4a158d80e8844a356d2d346d8f	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = f6959e0c9259d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = c7407ea65a45d901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d81df1059259d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = c7407ea65a45d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{A8472DE9-1E95-4E06-880F-C3BF6B181764} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

Venom RAT + HVNC.exe

pid	process
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe
4452	Venom RAT + HVNC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Venom RAT + HVNC.exe

pid process

4452 Venom RAT + HVNC.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

436 MicrosoftEdgeCP.exe
436 MicrosoftEdgeCP.exe

pid	process
436	MicrosoftEdgeCP.exe
436	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

Venom RAT + HVNC.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	4452	Venom RAT + HVNC.exe
Token: SeDebugPrivilege	3376	MicrosoftEdge.exe
Token: SeDebugPrivilege	3376	MicrosoftEdge.exe
Token: SeDebugPrivilege	3376	MicrosoftEdge.exe
Token: SeDebugPrivilege	3376	MicrosoftEdge.exe
Token: SeDebugPrivilege	1564	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1564	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1564	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1564	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3376	MicrosoftEdge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Venom RAT + HVNC.exe

pid process

4452 Venom RAT + HVNC.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Venom RAT + HVNC.exe

pid process

4452 Venom RAT + HVNC.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

Venom RAT + HVNC.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

4452 Venom RAT + HVNC.exe
4452 Venom RAT + HVNC.exe
3376 MicrosoftEdge.exe
436 MicrosoftEdgeCP.exe
436 MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

MicrosoftEdgeCP.exe

description	pid	process	target process
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 436 wrote to memory of 1564	436	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\Venom_RAT_5.6_[tombstone3#3883]\Venom_RAT_COMPILED\Venom RAT + HVNC.exe
"C:\Users\Admin\AppData\Local\Temp\Venom_RAT_5.6_[tombstone3#3883]\Venom_RAT_COMPILED\Venom RAT + HVNC.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4452

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3768

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3376

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4828

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\PYYS3P9L\favicon[1].png
Filesize
6KB

MD5
6aa46ede086bc0ca615bc229c0576455

SHA1
fcd2ef2d09e93c4d93d8348aa56147968a27ca4c

SHA256
323e0386709d099d7f793722c1d97aca90c8e0b9c7ac3ab26e34c3879800de8c

SHA512
121be3fe727650f52c1c721d9cc8ed5e3d687fda0c917699d12b7b45854caac668f70c5c2a292825a5c6593cefb29211ce29977dc7ad6d33c6d2e1237acf1148

Download Submit
C:\Users\Admin\AppData\Local\Temp\2e467f22-fd46-4a8b-b54a-a1ebefcab704\SiticoneDotNetRT64.dll
Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
\Users\Admin\AppData\Local\Temp\2e467f22-fd46-4a8b-b54a-a1ebefcab704\SiticoneDotNetRT64.dll
Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
memory/1564-409-0x0000018D73B90000-0x0000018D73B92000-memory.dmp

Filesize
8KB

Download
memory/1564-413-0x0000018D73BD0000-0x0000018D73BD2000-memory.dmp

Filesize
8KB

Download
memory/1564-359-0x0000018D743A0000-0x0000018D743A2000-memory.dmp

Filesize
8KB

Download
memory/1564-429-0x0000018D753B0000-0x0000018D753B2000-memory.dmp

Filesize
8KB

Download
memory/1564-427-0x0000018D75390000-0x0000018D75392000-memory.dmp

Filesize
8KB

Download
memory/1564-361-0x0000018D743C0000-0x0000018D743C2000-memory.dmp

Filesize
8KB

Download
memory/1564-423-0x0000018D75350000-0x0000018D75352000-memory.dmp

Filesize
8KB

Download
memory/1564-421-0x0000018D75330000-0x0000018D75338000-memory.dmp

Filesize
32KB

Download
memory/1564-419-0x0000018D745C0000-0x0000018D745C3000-memory.dmp

Filesize
12KB

Download
memory/1564-417-0x0000018D743F0000-0x0000018D743F2000-memory.dmp

Filesize
8KB

Download
memory/1564-415-0x0000018D73BF0000-0x0000018D73BF2000-memory.dmp

Filesize
8KB

Download
memory/1564-411-0x0000018D73BB0000-0x0000018D73BB2000-memory.dmp

Filesize
8KB

Download
memory/1564-407-0x0000018D73B70000-0x0000018D73B72000-memory.dmp

Filesize
8KB

Download
memory/1564-405-0x0000018D73B60000-0x0000018D73B62000-memory.dmp

Filesize
8KB

Download
memory/1564-403-0x0000018D73A60000-0x0000018D73A62000-memory.dmp

Filesize
8KB

Download
memory/1564-401-0x0000018D73860000-0x0000018D73862000-memory.dmp

Filesize
8KB

Download
memory/1564-399-0x0000018D73840000-0x0000018D73842000-memory.dmp

Filesize
8KB

Download
memory/1564-397-0x0000018D73820000-0x0000018D73822000-memory.dmp

Filesize
8KB

Download
memory/1564-368-0x0000018D72870000-0x0000018D72890000-memory.dmp

Filesize
128KB

Download
memory/1564-425-0x0000018D75370000-0x0000018D75372000-memory.dmp

Filesize
8KB

Download
memory/1564-431-0x0000018D753D0000-0x0000018D753D2000-memory.dmp

Filesize
8KB

Download
memory/1564-353-0x0000018D74160000-0x0000018D74162000-memory.dmp

Filesize
8KB

Download
memory/1564-355-0x0000018D74360000-0x0000018D74362000-memory.dmp

Filesize
8KB

Download
memory/1564-351-0x0000018D72DF0000-0x0000018D72DF2000-memory.dmp

Filesize
8KB

Download
memory/1564-357-0x0000018D74380000-0x0000018D74382000-memory.dmp

Filesize
8KB

Download
memory/3376-150-0x0000025741020000-0x0000025741030000-memory.dmp

Filesize
64KB

Download
memory/3376-187-0x00000257411E0000-0x00000257411E1000-memory.dmp

Filesize
4KB

Download
memory/3376-189-0x00000257416B0000-0x00000257416B2000-memory.dmp

Filesize
8KB

Download
memory/3376-191-0x0000025745B40000-0x0000025745B42000-memory.dmp

Filesize
8KB

Download
memory/3376-168-0x0000025741840000-0x0000025741850000-memory.dmp

Filesize
64KB

Download
memory/3376-382-0x0000025747540000-0x0000025747541000-memory.dmp

Filesize
4KB

Download
memory/3376-383-0x0000025747550000-0x0000025747551000-memory.dmp

Filesize
4KB

Download
memory/3376-192-0x0000025745BA0000-0x0000025745BA2000-memory.dmp

Filesize
8KB

Download
memory/4452-121-0x0000013539E10000-0x0000013539E22000-memory.dmp

Filesize
72KB

Download
memory/4452-137-0x00000135547B0000-0x00000135547C0000-memory.dmp

Filesize
64KB

Download
memory/4452-138-0x00000135547B0000-0x00000135547C0000-memory.dmp

Filesize
64KB

Download
memory/4452-141-0x00000135547B0000-0x00000135547C0000-memory.dmp

Filesize
64KB

Download
memory/4452-140-0x00000135547B0000-0x00000135547C0000-memory.dmp

Filesize
64KB

Download
memory/4452-120-0x0000013538AF0000-0x0000013539A82000-memory.dmp

Filesize
15.6MB

Download
memory/4452-139-0x00000135547B0000-0x00000135547C0000-memory.dmp

Filesize
64KB

Download
memory/4452-142-0x00000135547B0000-0x00000135547C0000-memory.dmp

Filesize
64KB

Download
memory/4452-123-0x0000013554B10000-0x0000013554D78000-memory.dmp

Filesize
2.4MB

Download
memory/4452-143-0x00000135586D0000-0x0000013558922000-memory.dmp

Filesize
2.3MB

Download
memory/4452-136-0x0000013557960000-0x000001355799E000-memory.dmp

Filesize
248KB

Download
memory/4452-135-0x00000135547B0000-0x00000135547C0000-memory.dmp

Filesize
64KB

Download
memory/4452-134-0x00000135547B0000-0x00000135547C0000-memory.dmp

Filesize
64KB

Download
memory/4452-133-0x00000135547B0000-0x00000135547C0000-memory.dmp

Filesize
64KB

Download
memory/4452-131-0x00000135547B0000-0x00000135547C0000-memory.dmp

Filesize
64KB

Download
memory/4452-132-0x00000135547B0000-0x00000135547C0000-memory.dmp

Filesize
64KB

Download
memory/4452-130-0x00007FFB7F840000-0x00007FFB7F96C000-memory.dmp

Filesize
1.2MB

Download
memory/4452-122-0x00000135547B0000-0x00000135547C0000-memory.dmp

Filesize
64KB

Download
memory/4452-609-0x00000135547B0000-0x00000135547C0000-memory.dmp

Filesize
64KB

Download
memory/4452-610-0x00000135547B0000-0x00000135547C0000-memory.dmp

Filesize
64KB

Download