Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system - submitted
22/04/2024, 11:43
Behavioral task
behavioral1
Sample
sclient.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
- Target sclient.exe
- Size 74KB
- Sample240422-nvpglaba2v
- SHA256 b79f88a2b7ba116fa4c0a2565d373db22bbbb312be647c352860b015927c6ec8
- MD5 e74473ce3c543742f9c9af0f50110394
- SHA1 267f50cbc58047fd7eb3c7e8b7cd9578da3969de
- SHA512 705fe63d572521b17bb68af179ebd1af989dcbd924e9dd3e057c035992607e7a07faa8c06d35da48efb9b4f93b42e2acff4f7af36e2be2d9e5cd5905cf3b9580
- SSDEEP 1536:hURAcxoXhCL2PMVn/PJGTIuH1bp/j4/QzcYxLVclN:hU+cxoxo2PMV3EH1bpk/QNxBY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
-
Default
Mutex
-
drlwrqqffwoynptzb
Attributes
-
delay
1
-
install
true
-
install_file
system32.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/095APLHG
aes.plain
Signatures
- Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023446-12.dat family_asyncrat - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation sclient.exe - Executes dropped EXE 1 IoCs
pid Process 4932 system32.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 46 IoCs
flow ioc 75 pastebin.com 77 pastebin.com 89 pastebin.com 104 pastebin.com 105 pastebin.com 41 pastebin.com 46 pastebin.com 53 pastebin.com 113 pastebin.com 123 pastebin.com 137 pastebin.com 127 pastebin.com 134 pastebin.com 40 pastebin.com 103 pastebin.com 108 pastebin.com 107 pastebin.com 124 pastebin.com 126 pastebin.com 56 pastebin.com 57 pastebin.com 100 pastebin.com 133 pastebin.com 76 pastebin.com 78 pastebin.com 102 pastebin.com 135 pastebin.com 84 pastebin.com 131 pastebin.com 132 pastebin.com 106 pastebin.com 125 pastebin.com 128 pastebin.com 129 pastebin.com 43 pastebin.com 73 pastebin.com 101 pastebin.com 130 pastebin.com 81 pastebin.com 83 pastebin.com 90 pastebin.com 99 pastebin.com 136 pastebin.com 54 pastebin.com 55 pastebin.com 67 pastebin.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4772 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2276 timeout.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 2768 sclient.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe 4932 system32.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2768 sclient.exe Token: SeDebugPrivilege 4932 system32.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4932 system32.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2768 wrote to memory of 2376 2768 sclient.exe 92 PID 2768 wrote to memory of 2376 2768 sclient.exe 92 PID 2768 wrote to memory of 2916 2768 sclient.exe 93 PID 2768 wrote to memory of 2916 2768 sclient.exe 93 PID 2916 wrote to memory of 2276 2916 cmd.exe 96 PID 2916 wrote to memory of 2276 2916 cmd.exe 96 PID 2376 wrote to memory of 4772 2376 cmd.exe 97 PID 2376 wrote to memory of 4772 2376 cmd.exe 97 PID 2916 wrote to memory of 4932 2916 cmd.exe 104 PID 2916 wrote to memory of 4932 2916 cmd.exe 104 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sclient.exe"C:\Users\Admin\AppData\Local\Temp\sclient.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "system32" /tr '"C:\Users\Admin\AppData\Roaming\system32.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "system32" /tr '"C:\Users\Admin\AppData\Roaming\system32.exe"'3⤵
- Creates scheduled task(s)
PID:4772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCDC0.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2276
-
-
C:\Users\Admin\AppData\Roaming\system32.exe"C:\Users\Admin\AppData\Roaming\system32.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4932
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\tmpCDC0.tmp.bat
- Size 152B
- SHA256 beaa2f9eded9f71c015e496c3ce8ef21b5f2ab82be72da4a1206b2efb8045dba
- MD5 aa40e75a1f58652975a374b006d1d25b
- SHA1 f7f59101c60b26bc59ec0a9471f01ae57e297c80
- SHA512 79d1b5ad24b20067e627694c476780c8c416480926f3d6403b0a6b893dd49b49df3733018e32ec9eab7fe5f2307c86d3af04602eed3387b1dec360ee8f5cb2d2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
- Size 8B
- SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
- MD5 cf759e4c5f14fe3eec41b87ed756cea8
- SHA1 c27c796bb3c2fac929359563676f4ba1ffada1f5
- SHA512 c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\system32.exe
- Size 74KB
- SHA256 b79f88a2b7ba116fa4c0a2565d373db22bbbb312be647c352860b015927c6ec8
- MD5 e74473ce3c543742f9c9af0f50110394
- SHA1 267f50cbc58047fd7eb3c7e8b7cd9578da3969de
- SHA512 705fe63d572521b17bb68af179ebd1af989dcbd924e9dd3e057c035992607e7a07faa8c06d35da48efb9b4f93b42e2acff4f7af36e2be2d9e5cd5905cf3b9580
- SSDEEP 1536:hURAcxoXhCL2PMVn/PJGTIuH1bp/j4/QzcYxLVclN:hU+cxoxo2PMV3EH1bpk/QNxBY
- MD5 SHA1 SHA512 SSDEEP