Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2024 09:06
Static task
static1
Behavioral task
behavioral1
Sample
13032024_1705_update.ps1
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
13032024_1705_update.ps1
Resource
win10v2004-20240226-en
General
-
Target
13032024_1705_update.ps1
-
Size
13.0MB
-
MD5
ffb99e756878951810566df652349d8f
-
SHA1
bc651703216d0e6bf1d13e3c8387defebfadc00c
-
SHA256
3c9bf0c7215cf48ec6dee4d5453335dee2fc40b629f30fe19e8433099dc793f2
-
SHA512
3bb146d8ba6b0f20522d0fb6acc95db4bb417388f8ee420eeee934006cf2903a46ac59c62386cd1dbf6f0bc12e6b18836c2e5d590470b70b505acd669e148952
-
SSDEEP
24576:rsbvdH27nGZlkWYoaFyTQ+rByBDGj8tbW2XfFBdg/qf35jeAwXsxMijIvqcEfxhU:PjxLsoaw0De0tdrL3nF4sEz8bXX
Malware Config
Extracted
asyncrat
5.0.5
Venom Clients
154.30.255.175:8890
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
powershell.exedescription pid process target process PID 4152 created 3360 4152 powershell.exe Explorer.EXE -
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3484-18-0x0000019CF7D90000-0x0000019CF7DA6000-memory.dmp family_asyncrat -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 4152 powershell.exe 4152 powershell.exe 4152 powershell.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
Processes:
powershell.exepid process 4152 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exenotepad.exedescription pid process Token: SeDebugPrivilege 4152 powershell.exe Token: SeDebugPrivilege 3484 notepad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
powershell.exedescription pid process target process PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe PID 4152 wrote to memory of 3484 4152 powershell.exe notepad.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\13032024_1705_update.ps12⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d22ifjqx.lf5.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/3484-20-0x0000019CF7E80000-0x0000019CF7E90000-memory.dmpFilesize
64KB
-
memory/3484-36-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmpFilesize
2.0MB
-
memory/3484-35-0x0000019CF7E80000-0x0000019CF7E90000-memory.dmpFilesize
64KB
-
memory/3484-34-0x0000019CF7E80000-0x0000019CF7E90000-memory.dmpFilesize
64KB
-
memory/3484-33-0x0000019CF7E80000-0x0000019CF7E90000-memory.dmpFilesize
64KB
-
memory/3484-32-0x00007FFCCF980000-0x00007FFCD0441000-memory.dmpFilesize
10.8MB
-
memory/3484-29-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmpFilesize
2.0MB
-
memory/3484-16-0x0000019CF6250000-0x0000019CF6266000-memory.dmpFilesize
88KB
-
memory/3484-17-0x00007FFCCF980000-0x00007FFCD0441000-memory.dmpFilesize
10.8MB
-
memory/3484-18-0x0000019CF7D90000-0x0000019CF7DA6000-memory.dmpFilesize
88KB
-
memory/3484-21-0x0000019CF7E80000-0x0000019CF7E90000-memory.dmpFilesize
64KB
-
memory/4152-14-0x000001F490240000-0x000001F49029B000-memory.dmpFilesize
364KB
-
memory/4152-19-0x00007FFCCF980000-0x00007FFCD0441000-memory.dmpFilesize
10.8MB
-
memory/4152-22-0x000001F4F8E90000-0x000001F4F8EA0000-memory.dmpFilesize
64KB
-
memory/4152-23-0x000001F4F8E90000-0x000001F4F8EA0000-memory.dmpFilesize
64KB
-
memory/4152-24-0x000001F4F8E90000-0x000001F4F8EA0000-memory.dmpFilesize
64KB
-
memory/4152-27-0x000001F490300000-0x000001F49035B000-memory.dmpFilesize
364KB
-
memory/4152-28-0x00007FFCCF980000-0x00007FFCD0441000-memory.dmpFilesize
10.8MB
-
memory/4152-15-0x000001F490300000-0x000001F49035B000-memory.dmpFilesize
364KB
-
memory/4152-13-0x000001F4F8E90000-0x000001F4F8EA0000-memory.dmpFilesize
64KB
-
memory/4152-12-0x000001F4F8E90000-0x000001F4F8EA0000-memory.dmpFilesize
64KB
-
memory/4152-11-0x000001F4F8E90000-0x000001F4F8EA0000-memory.dmpFilesize
64KB
-
memory/4152-10-0x00007FFCCF980000-0x00007FFCD0441000-memory.dmpFilesize
10.8MB
-
memory/4152-9-0x000001F4F9780000-0x000001F4F97A2000-memory.dmpFilesize
136KB