Analysis

  • max time kernel
    1757s
  • max time network
    1597s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2023 15:13

General

  • Target

    Venom5-HVNC-Rat.rar

  • Size

    29.4MB

  • MD5

    9c750cfbe1dbd4f4d87dcfc145d06237

  • SHA1

    67b5ca12ee20e6a1cdbf273d5a1736522fcdf649

  • SHA256

    9e3cde7a6f4c114daf5627a39a5999918f894489c922d82008cb21771f761d45

  • SHA512

    d0dc5ef150228d3dfe3583576f1cd16a25bda020e1a80ac19b708cd8c1ae661e3c96f96622ab10ecc00029fb9dfabeda3194c9f7fbf0e6d32bfecc45b5d2d65f

  • SSDEEP

    786432:QlrWp1qT/Jj8hGTGm1qH9ymV5l4BbulMulv9ymiIBjVul8B6ul7WP985iSGIfXN7:QlrWp+p8hsGmifB4BbpwfiejVlB6u89c

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Venom5-HVNC-Rat.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2592
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Venom5-HVNC-Rat.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2904
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Venom5-HVNC-Rat.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2900

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2900-82-0x000000013FFC0000-0x00000001400B8000-memory.dmp

    Filesize

    992KB

  • memory/2900-83-0x000007FEFADC0000-0x000007FEFADF4000-memory.dmp

    Filesize

    208KB

  • memory/2900-84-0x000007FEF5C90000-0x000007FEF5F44000-memory.dmp

    Filesize

    2.7MB

  • memory/2900-85-0x000007FEF7ED0000-0x000007FEF7EE8000-memory.dmp

    Filesize

    96KB

  • memory/2900-86-0x000007FEF7EB0000-0x000007FEF7EC7000-memory.dmp

    Filesize

    92KB

  • memory/2900-87-0x000007FEF6C80000-0x000007FEF6C91000-memory.dmp

    Filesize

    68KB

  • memory/2900-88-0x000007FEF6C20000-0x000007FEF6C37000-memory.dmp

    Filesize

    92KB

  • memory/2900-89-0x000007FEF6490000-0x000007FEF64A1000-memory.dmp

    Filesize

    68KB

  • memory/2900-90-0x000007FEF6470000-0x000007FEF648D000-memory.dmp

    Filesize

    116KB

  • memory/2900-91-0x000007FEF6450000-0x000007FEF6461000-memory.dmp

    Filesize

    68KB

  • memory/2900-92-0x000007FEF3FD0000-0x000007FEF507B000-memory.dmp

    Filesize

    16.7MB

  • memory/2900-93-0x000007FEF3C90000-0x000007FEF3E90000-memory.dmp

    Filesize

    2.0MB

  • memory/2900-94-0x000007FEF62F0000-0x000007FEF632F000-memory.dmp

    Filesize

    252KB

  • memory/2900-95-0x000007FEF62C0000-0x000007FEF62E1000-memory.dmp

    Filesize

    132KB

  • memory/2900-96-0x000007FEF3C00000-0x000007FEF3C18000-memory.dmp

    Filesize

    96KB

  • memory/2900-97-0x000007FEF3BE0000-0x000007FEF3BF1000-memory.dmp

    Filesize

    68KB

  • memory/2900-98-0x000007FEF3BC0000-0x000007FEF3BD1000-memory.dmp

    Filesize

    68KB

  • memory/2900-99-0x000007FEF3BA0000-0x000007FEF3BB1000-memory.dmp

    Filesize

    68KB

  • memory/2900-100-0x000007FEF3B80000-0x000007FEF3B9B000-memory.dmp

    Filesize

    108KB

  • memory/2900-101-0x000007FEF3B60000-0x000007FEF3B71000-memory.dmp

    Filesize

    68KB

  • memory/2900-102-0x000007FEF3B40000-0x000007FEF3B58000-memory.dmp

    Filesize

    96KB

  • memory/2900-103-0x000007FEF3B10000-0x000007FEF3B40000-memory.dmp

    Filesize

    192KB

  • memory/2900-104-0x000007FEF3AA0000-0x000007FEF3B07000-memory.dmp

    Filesize

    412KB

  • memory/2900-105-0x000007FEF3A30000-0x000007FEF3A9F000-memory.dmp

    Filesize

    444KB

  • memory/2900-106-0x000007FEF3A10000-0x000007FEF3A21000-memory.dmp

    Filesize

    68KB

  • memory/2900-107-0x000007FEF39B0000-0x000007FEF3A06000-memory.dmp

    Filesize

    344KB

  • memory/2900-108-0x000007FEF3980000-0x000007FEF39A8000-memory.dmp

    Filesize

    160KB

  • memory/2900-109-0x000007FEF3950000-0x000007FEF3974000-memory.dmp

    Filesize

    144KB

  • memory/2900-112-0x000007FEF38E0000-0x000007FEF38F1000-memory.dmp

    Filesize

    68KB

  • memory/2900-111-0x000007FEF3900000-0x000007FEF3923000-memory.dmp

    Filesize

    140KB

  • memory/2900-110-0x000007FEF3930000-0x000007FEF3947000-memory.dmp

    Filesize

    92KB

  • memory/2900-113-0x000007FEF38C0000-0x000007FEF38D2000-memory.dmp

    Filesize

    72KB

  • memory/2900-114-0x000007FEF3890000-0x000007FEF38B1000-memory.dmp

    Filesize

    132KB

  • memory/2900-115-0x000007FEF3870000-0x000007FEF3883000-memory.dmp

    Filesize

    76KB

  • memory/2900-116-0x000007FEF3850000-0x000007FEF3862000-memory.dmp

    Filesize

    72KB

  • memory/2900-117-0x000007FEF3710000-0x000007FEF384B000-memory.dmp

    Filesize

    1.2MB

  • memory/2900-118-0x000007FEF36E0000-0x000007FEF370C000-memory.dmp

    Filesize

    176KB

  • memory/2900-119-0x000007FEF3520000-0x000007FEF36D2000-memory.dmp

    Filesize

    1.7MB

  • memory/2900-121-0x000007FEF34A0000-0x000007FEF34B1000-memory.dmp

    Filesize

    68KB

  • memory/2900-120-0x000007FEF34C0000-0x000007FEF351C000-memory.dmp

    Filesize

    368KB

  • memory/2900-122-0x000007FEF3400000-0x000007FEF3497000-memory.dmp

    Filesize

    604KB

  • memory/2900-123-0x000007FEF33E0000-0x000007FEF33F2000-memory.dmp

    Filesize

    72KB

  • memory/2900-124-0x000007FEF31A0000-0x000007FEF33D1000-memory.dmp

    Filesize

    2.2MB

  • memory/2900-125-0x000007FEF3080000-0x000007FEF3192000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-126-0x000007FEF3040000-0x000007FEF3075000-memory.dmp

    Filesize

    212KB

  • memory/2900-127-0x000007FEF3010000-0x000007FEF3035000-memory.dmp

    Filesize

    148KB

  • memory/2900-128-0x000007FEF2FF0000-0x000007FEF3001000-memory.dmp

    Filesize

    68KB

  • memory/2900-129-0x000007FEF2F80000-0x000007FEF2FE1000-memory.dmp

    Filesize

    388KB

  • memory/2900-130-0x000007FEF2F60000-0x000007FEF2F71000-memory.dmp

    Filesize

    68KB

  • memory/2900-131-0x000007FEF2F40000-0x000007FEF2F52000-memory.dmp

    Filesize

    72KB

  • memory/2900-132-0x000007FEF2F20000-0x000007FEF2F33000-memory.dmp

    Filesize

    76KB

  • memory/2900-133-0x000007FEF2E80000-0x000007FEF2F1F000-memory.dmp

    Filesize

    636KB

  • memory/2900-134-0x000007FEF2E60000-0x000007FEF2E71000-memory.dmp

    Filesize

    68KB

  • memory/2900-135-0x000007FEF2D50000-0x000007FEF2E52000-memory.dmp

    Filesize

    1.0MB

  • memory/2900-136-0x000007FEF2D30000-0x000007FEF2D41000-memory.dmp

    Filesize

    68KB

  • memory/2900-137-0x000007FEF2D10000-0x000007FEF2D21000-memory.dmp

    Filesize

    68KB

  • memory/2900-138-0x000007FEF2CF0000-0x000007FEF2D01000-memory.dmp

    Filesize

    68KB

  • memory/2900-139-0x000007FEF2CD0000-0x000007FEF2CE2000-memory.dmp

    Filesize

    72KB

  • memory/2900-140-0x000007FEF2CB0000-0x000007FEF2CC8000-memory.dmp

    Filesize

    96KB

  • memory/2900-141-0x000007FEF2C90000-0x000007FEF2CA6000-memory.dmp

    Filesize

    88KB

  • memory/2900-143-0x000007FEF2C40000-0x000007FEF2C52000-memory.dmp

    Filesize

    72KB

  • memory/2900-142-0x000007FEF2C60000-0x000007FEF2C89000-memory.dmp

    Filesize

    164KB

  • memory/2900-144-0x000007FEF2C20000-0x000007FEF2C31000-memory.dmp

    Filesize

    68KB

  • memory/2900-145-0x000007FEF2C00000-0x000007FEF2C11000-memory.dmp

    Filesize

    68KB