800606d07c788db1b90747cf678c61c615d5c527b5d864a486d2b7c1551f4e08

Analysis

max time kernel
427s
max time network
1162s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
07/04/2024, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VenomRAT v6.0.3.7z
Size 40.4MB
Sample240407-dfdrfabg67
SHA256 800606d07c788db1b90747cf678c61c615d5c527b5d864a486d2b7c1551f4e08
MD5 4dc64273b5af94a5b48470ede1787d36
SHA1 2a85222a1289d9f060cc7c6adf9e6a8c0a10e0b4
SHA512 90fe6e9e4f002585f6ade846fe1f902a40e6d96029f66bb9106ba51033080759b587d7d6316963c84b44c48978d7d5ae0bf17a23b8a2034392dc68a1e8287ee8
SSDEEP 786432:Mr3p5i81Fz+5T47TW1e6p3omknMHPl37fp9XzG+um/rS/E1TSJTdtHjJcSNdtYs:Wh1R+eXWBxomkna+m/GEhSJ5dGs
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	5052	7zFM.exe
Token: 35	5052	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5052	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 236 wrote to memory of 5052	236	cmd.exe	80
PID 236 wrote to memory of 5052	236	cmd.exe	80

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3.7z"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:236
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3.7z"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads