Analysis
-
max time kernel
148s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
15/11/2023, 16:37
Behavioral task
behavioral1
Sample
NEAS.2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70.exe
-
Size
63KB
-
MD5
9c65c31fa60a7490db9ac229f88aeaec
-
SHA1
1165267dfffa7ac1443002fb331fd573d34132ae
-
SHA256
2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70
-
SHA512
f18cde1280543d32b442df89edb53420b5b40e1075cd3001bfe255557d9fe70670467e3005e68dc9e4bd0a2835a99bb7850eb4eefc866bb2bdd6dd177292eb61
-
SSDEEP
1536:ZnQpg/GiDABXOUcbbKwPoGoGfDpqKmY7:Zj/GiDu/cbbKEHgz
Malware Config
Extracted
asyncrat
Venom RAT 5.0.5
Test Paid not Crypted
142.202.188.173:9953
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
true
-
install_file
KDFManager.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 6 IoCs
resource yara_rule behavioral1/memory/2136-0-0x0000000000290000-0x00000000002A6000-memory.dmp asyncrat behavioral1/memory/2136-2-0x000000001B060000-0x000000001B0E0000-memory.dmp asyncrat behavioral1/files/0x00080000000120ed-16.dat asyncrat behavioral1/files/0x00080000000120ed-17.dat asyncrat behavioral1/memory/2608-18-0x0000000000B60000-0x0000000000B76000-memory.dmp asyncrat behavioral1/memory/2608-20-0x000000001A9F0000-0x000000001AA70000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2608 KDFManager.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2716 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2732 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2136 NEAS.2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70.exe 2136 NEAS.2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2136 NEAS.2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70.exe Token: SeDebugPrivilege 2608 KDFManager.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2112 2136 NEAS.2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70.exe 28 PID 2136 wrote to memory of 2112 2136 NEAS.2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70.exe 28 PID 2136 wrote to memory of 2112 2136 NEAS.2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70.exe 28 PID 2136 wrote to memory of 2120 2136 NEAS.2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70.exe 30 PID 2136 wrote to memory of 2120 2136 NEAS.2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70.exe 30 PID 2136 wrote to memory of 2120 2136 NEAS.2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70.exe 30 PID 2112 wrote to memory of 2716 2112 cmd.exe 32 PID 2112 wrote to memory of 2716 2112 cmd.exe 32 PID 2112 wrote to memory of 2716 2112 cmd.exe 32 PID 2120 wrote to memory of 2732 2120 cmd.exe 33 PID 2120 wrote to memory of 2732 2120 cmd.exe 33 PID 2120 wrote to memory of 2732 2120 cmd.exe 33 PID 2120 wrote to memory of 2608 2120 cmd.exe 34 PID 2120 wrote to memory of 2608 2120 cmd.exe 34 PID 2120 wrote to memory of 2608 2120 cmd.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "KDFManager" /tr '"C:\Users\Admin\AppData\Roaming\KDFManager.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "KDFManager" /tr '"C:\Users\Admin\AppData\Roaming\KDFManager.exe"'3⤵
- Creates scheduled task(s)
PID:2716
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp6E0F.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2732
-
-
C:\Users\Admin\AppData\Roaming\KDFManager.exe"C:\Users\Admin\AppData\Roaming\KDFManager.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154B
MD5f5f3fbe565bcf372a7cf93e0e9afd1ad
SHA1f3e1523f3d951319cebc998ad0f9a3b456f87ccf
SHA256706839335cdd9a4b7cd7290b872918139584292f37073cf9925679a24b18f704
SHA512b997d41321edbd1ee7d9c0086531eaae022e8a197c34a41ba27f633869f83e1a96b5e50868530a68c96412a6763cbee5ec7faf96939c25b2d79177799b3b8605
-
Filesize
154B
MD5f5f3fbe565bcf372a7cf93e0e9afd1ad
SHA1f3e1523f3d951319cebc998ad0f9a3b456f87ccf
SHA256706839335cdd9a4b7cd7290b872918139584292f37073cf9925679a24b18f704
SHA512b997d41321edbd1ee7d9c0086531eaae022e8a197c34a41ba27f633869f83e1a96b5e50868530a68c96412a6763cbee5ec7faf96939c25b2d79177799b3b8605
-
Filesize
63KB
MD59c65c31fa60a7490db9ac229f88aeaec
SHA11165267dfffa7ac1443002fb331fd573d34132ae
SHA2562a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70
SHA512f18cde1280543d32b442df89edb53420b5b40e1075cd3001bfe255557d9fe70670467e3005e68dc9e4bd0a2835a99bb7850eb4eefc866bb2bdd6dd177292eb61
-
Filesize
63KB
MD59c65c31fa60a7490db9ac229f88aeaec
SHA11165267dfffa7ac1443002fb331fd573d34132ae
SHA2562a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70
SHA512f18cde1280543d32b442df89edb53420b5b40e1075cd3001bfe255557d9fe70670467e3005e68dc9e4bd0a2835a99bb7850eb4eefc866bb2bdd6dd177292eb61