Analysis
- max time kernel
149s - max time network
119s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
07/05/2024, 17:05
Behavioral task
behavioral1
Sample
Cozios-Imagelogger-main/cozios ImageLogger.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
General
- Target Cozios-Imagelogger-main/cozios ImageLogger.exe
- Size 81KB
- Sample240507-vl5wjsfe2x
- SHA256 498b02baa4dee1f19d4d06e45e5eda8bbf386fcce695f07846ac5374c654e406
- MD5 23f472ba6e59df467b80af92f43eaf22
- SHA1 7dd4433d3f059ea4a13454991f841c756aba3e47
- SHA512 ecaa60619bc59a546a8100518d5866fc993ae2be340454e6b1ea6a9dc05efa33946198a0e798488659c99c959d937cc63e09ce746d254bcab8a12c233a088468
- SSDEEP 1536:DUxwcx/BVuCkmPMVhAz0M4zyAkIQH1by/4XOp4QzcQ633I6VclN:DU+cx/Bw/mPMVhA1BH1byl4Ql633IIY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
-
Default
Mutex
-
idjtweoowocnoy
Attributes
-
delay
1
-
install
true
-
install_file
Cozios Imagelogger.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/LwwcrLg4
aes.plain
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2716 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 2024 cozios ImageLogger.exe Token: SeIncreaseQuotaPrivilege 2024 cozios ImageLogger.exe Token: SeSecurityPrivilege 2024 cozios ImageLogger.exe Token: SeTakeOwnershipPrivilege 2024 cozios ImageLogger.exe Token: SeLoadDriverPrivilege 2024 cozios ImageLogger.exe Token: SeSystemProfilePrivilege 2024 cozios ImageLogger.exe Token: SeSystemtimePrivilege 2024 cozios ImageLogger.exe Token: SeProfSingleProcessPrivilege 2024 cozios ImageLogger.exe Token: SeIncBasePriorityPrivilege 2024 cozios ImageLogger.exe Token: SeCreatePagefilePrivilege 2024 cozios ImageLogger.exe Token: SeBackupPrivilege 2024 cozios ImageLogger.exe Token: SeRestorePrivilege 2024 cozios ImageLogger.exe Token: SeShutdownPrivilege 2024 cozios ImageLogger.exe Token: SeDebugPrivilege 2024 cozios ImageLogger.exe Token: SeSystemEnvironmentPrivilege 2024 cozios ImageLogger.exe Token: SeRemoteShutdownPrivilege 2024 cozios ImageLogger.exe Token: SeUndockPrivilege 2024 cozios ImageLogger.exe Token: SeManageVolumePrivilege 2024 cozios ImageLogger.exe Token: 33 2024 cozios ImageLogger.exe Token: 34 2024 cozios ImageLogger.exe Token: 35 2024 cozios ImageLogger.exe Token: SeIncreaseQuotaPrivilege 2024 cozios ImageLogger.exe Token: SeSecurityPrivilege 2024 cozios ImageLogger.exe Token: SeTakeOwnershipPrivilege 2024 cozios ImageLogger.exe Token: SeLoadDriverPrivilege 2024 cozios ImageLogger.exe Token: SeSystemProfilePrivilege 2024 cozios ImageLogger.exe Token: SeSystemtimePrivilege 2024 cozios ImageLogger.exe Token: SeProfSingleProcessPrivilege 2024 cozios ImageLogger.exe Token: SeIncBasePriorityPrivilege 2024 cozios ImageLogger.exe Token: SeCreatePagefilePrivilege 2024 cozios ImageLogger.exe Token: SeBackupPrivilege 2024 cozios ImageLogger.exe Token: SeRestorePrivilege 2024 cozios ImageLogger.exe Token: SeShutdownPrivilege 2024 cozios ImageLogger.exe Token: SeDebugPrivilege 2024 cozios ImageLogger.exe Token: SeSystemEnvironmentPrivilege 2024 cozios ImageLogger.exe Token: SeRemoteShutdownPrivilege 2024 cozios ImageLogger.exe Token: SeUndockPrivilege 2024 cozios ImageLogger.exe Token: SeManageVolumePrivilege 2024 cozios ImageLogger.exe Token: 33 2024 cozios ImageLogger.exe Token: 34 2024 cozios ImageLogger.exe Token: 35 2024 cozios ImageLogger.exe Token: SeDebugPrivilege 2716 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2484 mspaint.exe 2484 mspaint.exe 2484 mspaint.exe 2484 mspaint.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cozios-Imagelogger-main\cozios ImageLogger.exe"C:\Users\Admin\AppData\Local\Temp\Cozios-Imagelogger-main\cozios ImageLogger.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2716
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2484