Malware Analysis Report

2024-09-23 00:27

Sample ID 240505-ytjj3ace4x
Target VenomRatV6.0.1-main.zip
SHA256 839d3a89a01c66dc0d9d24a856d582be7acc57f09179875b638e67a9bc807832
Tags
rat stormkitty asyncrat default
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

839d3a89a01c66dc0d9d24a856d582be7acc57f09179875b638e67a9bc807832

Threat Level: Known bad

The file VenomRatV6.0.1-main.zip was found to be: Known bad.

Malicious Activity Summary

rat stormkitty asyncrat default

StormKitty payload

AsyncRat

Async RAT payload

Asyncrat family

Stormkitty family

Async RAT payload

Checks computer location settings

Executes dropped EXE

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-05 20:05

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Asyncrat family

asyncrat

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Stormkitty family

stormkitty

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-05 20:04

Reported

2024-05-05 20:07

Platform

win10v2004-20240426-en

Max time kernel

60s

Max time network

35s

Command Line

"C:\Users\Admin\AppData\Local\Temp\VenomRatV6.0.1-main\VenomRATV6.0.1\VenomRAT + HVNC + Stealer + Grabber.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\VenomRatV6.0.1-main\VenomRATV6.0.1\VenomRAT + HVNC + Stealer + Grabber.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\VenomRatV6.0.1-main\VenomRATV6.0.1\VenomRAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\AppData\Local\Temp\VenomRatV6.0.1-main\VenomRATV6.0.1\VenomRAT + HVNC + Stealer + Grabber.exe"

C:\Users\Admin\AppData\Local\Temp\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\AppData\Local\Temp\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Users\Admin\AppData\Local\Temp\Client.exe

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 57.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/872-0-0x00007FFC01943000-0x00007FFC01945000-memory.dmp

memory/872-1-0x0000000000CA0000-0x0000000001344000-memory.dmp

memory/872-2-0x00007FFC01940000-0x00007FFC02401000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 3b3a304c6fc7a3a1d9390d7cbff56634
SHA1 e8bd5244e6362968f5017680da33f1e90ae63dd7
SHA256 7331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58
SHA512 7f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5

C:\Users\Admin\AppData\Local\Temp\Client.exe

MD5 56b1282b2976b0084ec76cf0859ffc86
SHA1 0d21dc506301589d5fa5005d0addf3c00df04305
SHA256 135df43b3e1aa69bb90f4d4d07098fc1b3629be4c0447f8cfd45867c0116b41a
SHA512 7856e45e27c04124404e64b76048be1f3bfcd60269dc2039459962c98e513acf28bcc193f4baabb5ae48842f93378c0ff3c15e683f27be8c07e0e4f69b6b9218

memory/2032-28-0x00000000009B0000-0x00000000009C8000-memory.dmp

memory/1040-27-0x00007FFC01940000-0x00007FFC02401000-memory.dmp

memory/2032-30-0x00007FFC01940000-0x00007FFC02401000-memory.dmp

memory/2032-32-0x00007FFC01940000-0x00007FFC02401000-memory.dmp

memory/1040-31-0x000001FBD28B0000-0x000001FBD36E4000-memory.dmp

memory/872-26-0x00007FFC01940000-0x00007FFC02401000-memory.dmp

memory/1040-33-0x00007FFC01940000-0x00007FFC02401000-memory.dmp

memory/2032-34-0x00007FFC01940000-0x00007FFC02401000-memory.dmp