Malware Analysis Report

2025-01-03 06:39

Sample ID 230810-cma4fsha39
Target VenomRAT_v6.0.3_WITH_SOURCE.rar
SHA256 cdd6503c47b291d93491ac08319b741daf16ed4a84c9f655d949657672fdb728
Tags
default rat asyncrat stormkitty
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cdd6503c47b291d93491ac08319b741daf16ed4a84c9f655d949657672fdb728

Threat Level: Known bad

The file VenomRAT_v6.0.3_WITH_SOURCE.rar was found to be: Known bad.

Malicious Activity Summary

default rat asyncrat stormkitty

Asyncrat family

StormKitty payload

Stormkitty family

Async RAT payload

AsyncRat

Async RAT payload

Executes dropped EXE

Program crash

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Opens file in notepad (likely ransom note)

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-08-10 02:12

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Asyncrat family

asyncrat

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Stormkitty family

stormkitty

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral10

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

128s

Max time network

311s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.DataAccess.v22.2.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.DataAccess.v22.2.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 126.158.241.8.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

129s

Max time network

274s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Printing.v22.2.Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Printing.v22.2.Core.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

127s

Max time network

309s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Sparkline.v22.1.Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Sparkline.v22.1.Core.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 126.138.241.8.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 152.141.79.40.in-addr.arpa udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

120s

Max time network

307s

Command Line

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\Clientx64.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\Clientx64.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\Clientx64.exe

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\Clientx64.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 420 -p 4924 -ip 4924

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4924 -s 952

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

memory/4924-133-0x0000000000820000-0x0000000000838000-memory.dmp

memory/4924-135-0x00007FFD23880000-0x00007FFD24341000-memory.dmp

memory/4924-136-0x000000001B4C0000-0x000000001B4D0000-memory.dmp

memory/4924-137-0x00007FFD23880000-0x00007FFD24341000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

133s

Max time network

310s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Diagram.v22.2.Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Diagram.v22.2.Core.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 0.77.109.52.in-addr.arpa udp
US 8.8.8.8:53 8.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

71s

Max time network

200s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Images.v22.2.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Images.v22.2.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 126.129.241.8.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

117s

Max time network

260s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Pdf.v22.2.Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Pdf.v22.2.Core.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 203.151.224.20.in-addr.arpa udp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

132s

Max time network

268s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Office.v22.1.Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Office.v22.1.Core.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

118s

Max time network

260s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Office.v22.2.Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Office.v22.2.Core.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 126.140.241.8.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

133s

Max time network

310s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.RichEdit.v22.2.Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.RichEdit.v22.2.Core.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

113s

Max time network

253s

Command Line

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\Clientx86.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\Clientx86.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\Clientx86.exe

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\Clientx86.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2472 -ip 2472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 1020

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 0.77.109.52.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

memory/2472-134-0x0000000000D60000-0x0000000000D78000-memory.dmp

memory/2472-133-0x0000000074CD0000-0x0000000075480000-memory.dmp

memory/2472-135-0x0000000005E50000-0x00000000063F4000-memory.dmp

memory/2472-137-0x0000000005890000-0x00000000058A0000-memory.dmp

memory/2472-138-0x0000000074CD0000-0x0000000075480000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

128s

Max time network

310s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Mvvm.v22.2.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Mvvm.v22.2.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

130s

Max time network

310s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Pdf.v22.1.Drawing.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Pdf.v22.1.Drawing.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 8.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

125s

Max time network

269s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Pdf.v22.2.Drawing.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Pdf.v22.2.Drawing.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 0.77.109.52.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:36

Platform

win10v2004-20230703-en

Max time kernel

117s

Max time network

271s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.PivotGrid.v22.2.Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.PivotGrid.v22.2.Core.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

294s

Max time network

317s

Command Line

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe"

Signatures

AsyncRat

rat asyncrat

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
AT 93.82.44.26:4040 tcp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
AT 93.82.44.26:4040 tcp
AT 93.82.44.26:4040 tcp
US 8.8.8.8:53 126.158.241.8.in-addr.arpa udp
US 8.8.8.8:53 233.141.123.20.in-addr.arpa udp
AT 93.82.44.26:4040 tcp
AT 93.82.44.26:4040 tcp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp
AT 93.82.44.26:4040 tcp
AT 93.82.44.26:4040 tcp
AT 93.82.44.26:4040 tcp
AT 93.82.44.26:4040 tcp
AT 93.82.44.26:4040 tcp
AT 93.82.44.26:4040 tcp
AT 93.82.44.26:4040 tcp
AT 93.82.44.26:4040 tcp

Files

memory/4964-133-0x0000000000430000-0x0000000000446000-memory.dmp

memory/4964-135-0x00007FFF85E00000-0x00007FFF868C1000-memory.dmp

memory/4964-136-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

memory/4964-137-0x00007FFF85E00000-0x00007FFF868C1000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

129s

Max time network

272s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Charts.v22.2.Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Charts.v22.2.Core.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

83s

Max time network

199s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Data.Desktop.v22.1.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Data.Desktop.v22.1.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

131s

Max time network

272s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Data.v22.1.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Data.v22.1.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 126.140.241.8.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 0.77.109.52.in-addr.arpa udp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

110s

Max time network

294s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Data.v22.2.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Data.v22.2.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 126.134.241.8.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:36

Platform

win10v2004-20230703-en

Max time kernel

118s

Max time network

307s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Drawing.v22.1.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Drawing.v22.1.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

117s

Max time network

260s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Printing.v22.1.Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Printing.v22.1.Core.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

128s

Max time network

310s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.RichEdit.v22.1.Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.RichEdit.v22.1.Core.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 0.77.109.52.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

129s

Max time network

274s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.RichEdit.v22.2.Export.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.RichEdit.v22.2.Export.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 126.143.241.8.in-addr.arpa udp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:36

Platform

win10v2004-20230703-en

Max time kernel

108s

Max time network

269s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Sparkline.v22.2.Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Sparkline.v22.2.Core.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 203.151.224.20.in-addr.arpa udp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

294s

Max time network

314s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\BouncyCastle.Crypto.dll",#1

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Keylogger.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Keylogger.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1512 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom v6.0.3.exe C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe
PID 1512 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom v6.0.3.exe C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe
PID 1512 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom v6.0.3.exe C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe
PID 1512 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom v6.0.3.exe C:\Users\Admin\AppData\Local\Temp\Venomrat.exe
PID 1512 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom v6.0.3.exe C:\Users\Admin\AppData\Local\Temp\Venomrat.exe
PID 1044 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe
PID 1044 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe
PID 3456 wrote to memory of 5072 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 3456 wrote to memory of 5072 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 4492 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom v6.0.3.exe C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe
PID 4492 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom v6.0.3.exe C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe
PID 4492 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom v6.0.3.exe C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe
PID 4492 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom v6.0.3.exe C:\Users\Admin\AppData\Local\Temp\Venomrat.exe
PID 4492 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom v6.0.3.exe C:\Users\Admin\AppData\Local\Temp\Venomrat.exe
PID 4192 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe
PID 4192 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\BouncyCastle.Crypto.dll",#1

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Client.exe"

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom v6.0.3.exe

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom v6.0.3.exe"

C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe

"C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe"

C:\Users\Admin\AppData\Local\Temp\Venomrat.exe

"C:\Users\Admin\AppData\Local\Temp\Venomrat.exe"

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 416 -p 3744 -ip 3744

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3744 -s 1716

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 500 -p 404 -ip 404

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 404 -s 2420

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 520 -p 3744 -ip 3744

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 548 -p 404 -ip 404

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3744 -s 1708

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 404 -s 2420

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe.config

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom v6.0.3.exe

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom v6.0.3.exe"

C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe

"C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe"

C:\Users\Admin\AppData\Local\Temp\Venomrat.exe

"C:\Users\Admin\AppData\Local\Temp\Venomrat.exe"

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 540 -p 1464 -ip 1464

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1464 -s 1400

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 544 -p 2124 -ip 2124

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2124 -s 1396

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 580 -p 1464 -ip 1464

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Keylogger.exe

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Keylogger.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1464 -s 1400

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 520 -p 2124 -ip 2124

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2124 -s 2324

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Keylogger.exe

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Keylogger.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 126.129.241.8.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 126.158.241.8.in-addr.arpa udp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp
AT 93.82.44.26:4040 tcp
AT 93.82.44.26:4040 tcp
AT 93.82.44.26:4040 tcp
AT 93.82.44.26:4040 tcp
AT 93.82.44.26:4040 tcp
AT 93.82.44.26:4040 tcp

Files

memory/3312-133-0x0000000000130000-0x0000000000146000-memory.dmp

memory/3312-135-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/3312-136-0x000000001BD60000-0x000000001BD70000-memory.dmp

memory/3312-137-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/3312-138-0x000000001BD60000-0x000000001BD70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe

MD5 7e8d3bcd4b3ee0a20deb79e5818f06a0
SHA1 73acfa8fbe3aa5ab8372cf8d11eba9242ba4592e
SHA256 baa304c80cd2acc0df7968024a0754d560dfd2fafc14dfc6383783e3d2f8127e
SHA512 2ca9b6ec0f22d586388caf3d4da20e25ba46aac0cee7d6e98f8ddeb3cddbc346d632a3717c6902b065e6fb5d8628ff08f8a306f1ca539f905fbfb1a06f7222c9

C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe

MD5 7e8d3bcd4b3ee0a20deb79e5818f06a0
SHA1 73acfa8fbe3aa5ab8372cf8d11eba9242ba4592e
SHA256 baa304c80cd2acc0df7968024a0754d560dfd2fafc14dfc6383783e3d2f8127e
SHA512 2ca9b6ec0f22d586388caf3d4da20e25ba46aac0cee7d6e98f8ddeb3cddbc346d632a3717c6902b065e6fb5d8628ff08f8a306f1ca539f905fbfb1a06f7222c9

C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe

MD5 7e8d3bcd4b3ee0a20deb79e5818f06a0
SHA1 73acfa8fbe3aa5ab8372cf8d11eba9242ba4592e
SHA256 baa304c80cd2acc0df7968024a0754d560dfd2fafc14dfc6383783e3d2f8127e
SHA512 2ca9b6ec0f22d586388caf3d4da20e25ba46aac0cee7d6e98f8ddeb3cddbc346d632a3717c6902b065e6fb5d8628ff08f8a306f1ca539f905fbfb1a06f7222c9

C:\Users\Admin\AppData\Local\Temp\Venomrat.exe

MD5 f6cd31be1b934e979780c63ee6dca10c
SHA1 7f802a7409345d03bef6d292b91e096a97c7f25a
SHA256 c7d808cc2f536c8aef33b34415bffa55d32ecdfb23dd34ec95d76f934c40ea12
SHA512 bef7835728afb40e05a322a331b6a7a7f99b37d0dea0d883b4c0afa0e697f0801847680202d19d99f934b29d3b934a6d41a0e623945c7af469fb842354a0c6f9

C:\Users\Admin\AppData\Local\Temp\Venomrat.exe

MD5 f6cd31be1b934e979780c63ee6dca10c
SHA1 7f802a7409345d03bef6d292b91e096a97c7f25a
SHA256 c7d808cc2f536c8aef33b34415bffa55d32ecdfb23dd34ec95d76f934c40ea12
SHA512 bef7835728afb40e05a322a331b6a7a7f99b37d0dea0d883b4c0afa0e697f0801847680202d19d99f934b29d3b934a6d41a0e623945c7af469fb842354a0c6f9

C:\Users\Admin\AppData\Local\Temp\Venomrat.exe

MD5 f6cd31be1b934e979780c63ee6dca10c
SHA1 7f802a7409345d03bef6d292b91e096a97c7f25a
SHA256 c7d808cc2f536c8aef33b34415bffa55d32ecdfb23dd34ec95d76f934c40ea12
SHA512 bef7835728afb40e05a322a331b6a7a7f99b37d0dea0d883b4c0afa0e697f0801847680202d19d99f934b29d3b934a6d41a0e623945c7af469fb842354a0c6f9

memory/4868-159-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/4868-160-0x0000000000690000-0x00000000006A8000-memory.dmp

C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

MD5 cf759e4c5f14fe3eec41b87ed756cea8
SHA1 c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512 c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 3b3a304c6fc7a3a1d9390d7cbff56634
SHA1 e8bd5244e6362968f5017680da33f1e90ae63dd7
SHA256 7331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58
SHA512 7f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5

memory/4868-169-0x000000001B2B0000-0x000000001B2C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 3b3a304c6fc7a3a1d9390d7cbff56634
SHA1 e8bd5244e6362968f5017680da33f1e90ae63dd7
SHA256 7331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58
SHA512 7f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 3b3a304c6fc7a3a1d9390d7cbff56634
SHA1 e8bd5244e6362968f5017680da33f1e90ae63dd7
SHA256 7331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58
SHA512 7f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5

memory/404-173-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/404-174-0x000001A0A4C00000-0x000001A0A5A34000-memory.dmp

memory/404-175-0x000001A0C13A0000-0x000001A0C27A4000-memory.dmp

memory/404-176-0x000001A0C05B0000-0x000001A0C0AC2000-memory.dmp

memory/404-177-0x000001A0C02F0000-0x000001A0C0542000-memory.dmp

memory/4868-179-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/404-180-0x000001A0A7670000-0x000001A0A7680000-memory.dmp

memory/404-181-0x000001A0C0BE0000-0x000001A0C0CB8000-memory.dmp

memory/404-182-0x000001A0C01D0000-0x000001A0C0220000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 3b3a304c6fc7a3a1d9390d7cbff56634
SHA1 e8bd5244e6362968f5017680da33f1e90ae63dd7
SHA256 7331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58
SHA512 7f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5

memory/404-184-0x000001A0C4A50000-0x000001A0C520E000-memory.dmp

memory/3744-185-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/404-187-0x000001A0C4630000-0x000001A0C49CC000-memory.dmp

memory/404-186-0x000001A0C5210000-0x000001A0C58A2000-memory.dmp

memory/404-188-0x000001A0C5D40000-0x000001A0C61C4000-memory.dmp

memory/404-190-0x000001A0BFF30000-0x000001A0BFF50000-memory.dmp

memory/3744-191-0x0000019E2ED10000-0x0000019E2ED20000-memory.dmp

memory/404-189-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/404-192-0x000001A0A7670000-0x000001A0A7680000-memory.dmp

memory/404-193-0x000001A0C5A90000-0x000001A0C5CA2000-memory.dmp

memory/404-194-0x000001A0A7670000-0x000001A0A7680000-memory.dmp

memory/3744-195-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/3744-196-0x0000019E2ED10000-0x0000019E2ED20000-memory.dmp

memory/404-197-0x000001A0A7670000-0x000001A0A7680000-memory.dmp

memory/3744-198-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/404-199-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sistrdzthu.exe

MD5 7e8d3bcd4b3ee0a20deb79e5818f06a0
SHA1 73acfa8fbe3aa5ab8372cf8d11eba9242ba4592e
SHA256 baa304c80cd2acc0df7968024a0754d560dfd2fafc14dfc6383783e3d2f8127e
SHA512 2ca9b6ec0f22d586388caf3d4da20e25ba46aac0cee7d6e98f8ddeb3cddbc346d632a3717c6902b065e6fb5d8628ff08f8a306f1ca539f905fbfb1a06f7222c9

C:\Users\Admin\AppData\Local\Temp\Venomrat.exe

MD5 f6cd31be1b934e979780c63ee6dca10c
SHA1 7f802a7409345d03bef6d292b91e096a97c7f25a
SHA256 c7d808cc2f536c8aef33b34415bffa55d32ecdfb23dd34ec95d76f934c40ea12
SHA512 bef7835728afb40e05a322a331b6a7a7f99b37d0dea0d883b4c0afa0e697f0801847680202d19d99f934b29d3b934a6d41a0e623945c7af469fb842354a0c6f9

C:\Users\Admin\AppData\Local\Temp\Venomrat.exe

MD5 f6cd31be1b934e979780c63ee6dca10c
SHA1 7f802a7409345d03bef6d292b91e096a97c7f25a
SHA256 c7d808cc2f536c8aef33b34415bffa55d32ecdfb23dd34ec95d76f934c40ea12
SHA512 bef7835728afb40e05a322a331b6a7a7f99b37d0dea0d883b4c0afa0e697f0801847680202d19d99f934b29d3b934a6d41a0e623945c7af469fb842354a0c6f9

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Venomrat.exe.log

MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

memory/392-220-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/392-221-0x000000001B720000-0x000000001B730000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 3b3a304c6fc7a3a1d9390d7cbff56634
SHA1 e8bd5244e6362968f5017680da33f1e90ae63dd7
SHA256 7331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58
SHA512 7f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 3b3a304c6fc7a3a1d9390d7cbff56634
SHA1 e8bd5244e6362968f5017680da33f1e90ae63dd7
SHA256 7331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58
SHA512 7f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5

memory/1464-232-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/1464-233-0x000001A53DC90000-0x000001A53DCA0000-memory.dmp

memory/392-234-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 3b3a304c6fc7a3a1d9390d7cbff56634
SHA1 e8bd5244e6362968f5017680da33f1e90ae63dd7
SHA256 7331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58
SHA512 7f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5

memory/2124-236-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/2124-237-0x0000029532E00000-0x0000029532E10000-memory.dmp

memory/1464-238-0x000001A53DC90000-0x000001A53DCA0000-memory.dmp

memory/2124-239-0x0000029532E00000-0x0000029532E10000-memory.dmp

memory/1464-240-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/3872-241-0x0000000000280000-0x0000000000288000-memory.dmp

memory/3872-242-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/1464-243-0x000001A53DC90000-0x000001A53DCA0000-memory.dmp

memory/1464-244-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/2124-245-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/2124-246-0x0000029532E00000-0x0000029532E10000-memory.dmp

memory/4388-247-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/4388-248-0x000000001BA80000-0x000000001BA90000-memory.dmp

memory/2124-249-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/3872-250-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/3872-251-0x00000000022F0000-0x0000000002300000-memory.dmp

memory/4388-252-0x00007FFF2A460000-0x00007FFF2AF21000-memory.dmp

memory/4388-253-0x000000001BA80000-0x000000001BA90000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

129s

Max time network

297s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.CodeParser.v22.2.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.CodeParser.v22.2.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 126.158.241.8.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

113s

Max time network

259s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.DataVisualization.v22.2.Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.DataVisualization.v22.2.Core.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 9.179.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

300s

Max time network

320s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Pdf.v22.1.Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Pdf.v22.1.Core.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.77.109.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:36

Platform

win10v2004-20230703-en

Max time kernel

99s

Max time network

265s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Data.Desktop.v22.2.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.Data.Desktop.v22.2.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 0.77.109.52.in-addr.arpa udp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

130s

Max time network

270s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.DataAccess.v22.2.UI.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\DevExpress.DataAccess.v22.2.UI.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 126.158.241.8.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2023-08-10 02:11

Reported

2023-08-10 02:35

Platform

win10v2004-20230703-en

Max time kernel

111s

Max time network

254s

Command Line

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\ClientAny.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\ClientAny.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\ClientAny.exe

"C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3_WITH_SOURCE\VenomRAT v6.0.3 (SOURCE)\Stub\ClientAny.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 408 -p 4364 -ip 4364

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4364 -s 956

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 126.158.241.8.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

memory/4364-134-0x0000000000900000-0x0000000000918000-memory.dmp

memory/4364-136-0x00007FF8C18E0000-0x00007FF8C23A1000-memory.dmp

memory/4364-137-0x000000001B5A0000-0x000000001B5B0000-memory.dmp

memory/4364-138-0x00007FF8C18E0000-0x00007FF8C23A1000-memory.dmp