Analysis
- max time kernel
136s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
07/05/2024, 17:05
Behavioral task
behavioral1
Sample
Cozios-Imagelogger-main/cozios ImageLogger.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
General
- Target Cozios-Imagelogger-main/cozios ImageLogger.exe
- Size 81KB
- Sample240507-vl5wjsfe2x
- SHA256 498b02baa4dee1f19d4d06e45e5eda8bbf386fcce695f07846ac5374c654e406
- MD5 23f472ba6e59df467b80af92f43eaf22
- SHA1 7dd4433d3f059ea4a13454991f841c756aba3e47
- SHA512 ecaa60619bc59a546a8100518d5866fc993ae2be340454e6b1ea6a9dc05efa33946198a0e798488659c99c959d937cc63e09ce746d254bcab8a12c233a088468
- SSDEEP 1536:DUxwcx/BVuCkmPMVhAz0M4zyAkIQH1by/4XOp4QzcQ633I6VclN:DU+cx/Bw/mPMVhA1BH1byl4Ql633IIY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
-
Default
Mutex
-
idjtweoowocnoy
Attributes
-
delay
1
-
install
true
-
install_file
Cozios Imagelogger.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/LwwcrLg4
aes.plain
Signatures
- Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2564 cozios ImageLogger.exe Token: SeIncreaseQuotaPrivilege 2564 cozios ImageLogger.exe Token: SeSecurityPrivilege 2564 cozios ImageLogger.exe Token: SeTakeOwnershipPrivilege 2564 cozios ImageLogger.exe Token: SeLoadDriverPrivilege 2564 cozios ImageLogger.exe Token: SeSystemProfilePrivilege 2564 cozios ImageLogger.exe Token: SeSystemtimePrivilege 2564 cozios ImageLogger.exe Token: SeProfSingleProcessPrivilege 2564 cozios ImageLogger.exe Token: SeIncBasePriorityPrivilege 2564 cozios ImageLogger.exe Token: SeCreatePagefilePrivilege 2564 cozios ImageLogger.exe Token: SeBackupPrivilege 2564 cozios ImageLogger.exe Token: SeRestorePrivilege 2564 cozios ImageLogger.exe Token: SeShutdownPrivilege 2564 cozios ImageLogger.exe Token: SeDebugPrivilege 2564 cozios ImageLogger.exe Token: SeSystemEnvironmentPrivilege 2564 cozios ImageLogger.exe Token: SeRemoteShutdownPrivilege 2564 cozios ImageLogger.exe Token: SeUndockPrivilege 2564 cozios ImageLogger.exe Token: SeManageVolumePrivilege 2564 cozios ImageLogger.exe Token: 33 2564 cozios ImageLogger.exe Token: 34 2564 cozios ImageLogger.exe Token: 35 2564 cozios ImageLogger.exe Token: 36 2564 cozios ImageLogger.exe Token: SeIncreaseQuotaPrivilege 2564 cozios ImageLogger.exe Token: SeSecurityPrivilege 2564 cozios ImageLogger.exe Token: SeTakeOwnershipPrivilege 2564 cozios ImageLogger.exe Token: SeLoadDriverPrivilege 2564 cozios ImageLogger.exe Token: SeSystemProfilePrivilege 2564 cozios ImageLogger.exe Token: SeSystemtimePrivilege 2564 cozios ImageLogger.exe Token: SeProfSingleProcessPrivilege 2564 cozios ImageLogger.exe Token: SeIncBasePriorityPrivilege 2564 cozios ImageLogger.exe Token: SeCreatePagefilePrivilege 2564 cozios ImageLogger.exe Token: SeBackupPrivilege 2564 cozios ImageLogger.exe Token: SeRestorePrivilege 2564 cozios ImageLogger.exe Token: SeShutdownPrivilege 2564 cozios ImageLogger.exe Token: SeDebugPrivilege 2564 cozios ImageLogger.exe Token: SeSystemEnvironmentPrivilege 2564 cozios ImageLogger.exe Token: SeRemoteShutdownPrivilege 2564 cozios ImageLogger.exe Token: SeUndockPrivilege 2564 cozios ImageLogger.exe Token: SeManageVolumePrivilege 2564 cozios ImageLogger.exe Token: 33 2564 cozios ImageLogger.exe Token: 34 2564 cozios ImageLogger.exe Token: 35 2564 cozios ImageLogger.exe Token: 36 2564 cozios ImageLogger.exe