Resubmissions
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 12:28
Static task
static1
Behavioral task
behavioral1
Sample
e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exe
Resource
win10v2004-20240426-en
General
-
Target
e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exe
-
Size
231KB
-
MD5
144f1b1c4b9cdad97d8dd1a3a89e7ea1
-
SHA1
1a11d76a6ab646a0d699efa0e5fc71de6e5af92c
-
SHA256
e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944
-
SHA512
2697bde82afdef6b3e9079e9add7a9026fffec2a9093932d6c05256fe73df0ef9a2fac4f26de28e2b5d87cc7dd0651dac80baa2a3841148409ab2c3ea32b6882
-
SSDEEP
6144:TZ+geAPqybJnO5AbpbO9jhJdrz8U6n4eOP07NyGyG2qYlw5S3U19:T4FvybJNpazzfoyG
Malware Config
Extracted
asyncrat
Default
66.235.168.242:3232
-
delay
1
-
install
true
-
install_file
Loaader.exe
-
install_folder
%AppData%
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
66.235.168.242:4449
scgofjarww
-
delay
1
-
install
true
-
install_file
Loader.exe
-
install_folder
%AppData%
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2084-7-0x00000000001B0000-0x00000000001C8000-memory.dmp VenomRAT C:\Users\Admin\AppData\Local\Temp\Client.exe VenomRAT behavioral1/memory/2492-53-0x0000000001080000-0x0000000001098000-memory.dmp VenomRAT -
Async RAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Infected.exe family_asyncrat C:\Users\Admin\AppData\Local\Temp\Client.exe family_asyncrat -
Executes dropped EXE 5 IoCs
Processes:
Client.exeInfected.exeWinDefend.exeLoader.exeLoaader.exepid process 2084 Client.exe 1332 Infected.exe 2948 WinDefend.exe 2492 Loader.exe 2828 Loaader.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
WinDefend.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\YourAppName = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinDefend.exe" WinDefend.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api64.ipify.org 5 api64.ipify.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2288 schtasks.exe 2540 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 3004 timeout.exe 2752 timeout.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
Infected.exeClient.exeLoader.exepid process 1332 Infected.exe 1332 Infected.exe 1332 Infected.exe 2084 Client.exe 2084 Client.exe 2084 Client.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe 2492 Loader.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
Client.exeInfected.exeWinDefend.exeLoader.exeLoaader.exedescription pid process Token: SeDebugPrivilege 2084 Client.exe Token: SeDebugPrivilege 1332 Infected.exe Token: SeDebugPrivilege 2948 WinDefend.exe Token: SeDebugPrivilege 2492 Loader.exe Token: SeDebugPrivilege 2828 Loaader.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Loader.exepid process 2492 Loader.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exeInfected.execmd.execmd.exeClient.execmd.execmd.exedescription pid process target process PID 2180 wrote to memory of 2084 2180 e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exe Client.exe PID 2180 wrote to memory of 2084 2180 e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exe Client.exe PID 2180 wrote to memory of 2084 2180 e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exe Client.exe PID 2180 wrote to memory of 1332 2180 e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exe Infected.exe PID 2180 wrote to memory of 1332 2180 e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exe Infected.exe PID 2180 wrote to memory of 1332 2180 e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exe Infected.exe PID 2180 wrote to memory of 2948 2180 e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exe WinDefend.exe PID 2180 wrote to memory of 2948 2180 e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exe WinDefend.exe PID 2180 wrote to memory of 2948 2180 e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exe WinDefend.exe PID 2180 wrote to memory of 2948 2180 e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exe WinDefend.exe PID 1332 wrote to memory of 2744 1332 Infected.exe cmd.exe PID 1332 wrote to memory of 2744 1332 Infected.exe cmd.exe PID 1332 wrote to memory of 2744 1332 Infected.exe cmd.exe PID 1332 wrote to memory of 2668 1332 Infected.exe cmd.exe PID 1332 wrote to memory of 2668 1332 Infected.exe cmd.exe PID 1332 wrote to memory of 2668 1332 Infected.exe cmd.exe PID 2744 wrote to memory of 2288 2744 cmd.exe schtasks.exe PID 2744 wrote to memory of 2288 2744 cmd.exe schtasks.exe PID 2744 wrote to memory of 2288 2744 cmd.exe schtasks.exe PID 2668 wrote to memory of 3004 2668 cmd.exe timeout.exe PID 2668 wrote to memory of 3004 2668 cmd.exe timeout.exe PID 2668 wrote to memory of 3004 2668 cmd.exe timeout.exe PID 2084 wrote to memory of 2988 2084 Client.exe cmd.exe PID 2084 wrote to memory of 2988 2084 Client.exe cmd.exe PID 2084 wrote to memory of 2988 2084 Client.exe cmd.exe PID 2084 wrote to memory of 2568 2084 Client.exe cmd.exe PID 2084 wrote to memory of 2568 2084 Client.exe cmd.exe PID 2084 wrote to memory of 2568 2084 Client.exe cmd.exe PID 2988 wrote to memory of 2540 2988 cmd.exe schtasks.exe PID 2988 wrote to memory of 2540 2988 cmd.exe schtasks.exe PID 2988 wrote to memory of 2540 2988 cmd.exe schtasks.exe PID 2568 wrote to memory of 2752 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2752 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2752 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2492 2568 cmd.exe Loader.exe PID 2568 wrote to memory of 2492 2568 cmd.exe Loader.exe PID 2568 wrote to memory of 2492 2568 cmd.exe Loader.exe PID 2668 wrote to memory of 2828 2668 cmd.exe Loaader.exe PID 2668 wrote to memory of 2828 2668 cmd.exe Loaader.exe PID 2668 wrote to memory of 2828 2668 cmd.exe Loaader.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exe"C:\Users\Admin\AppData\Local\Temp\e3f245020bcf6beaca39b8cc9eb06b3db7f209356e765f41d8306ad56735e944.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loader" /tr '"C:\Users\Admin\AppData\Roaming\Loader.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Loader" /tr '"C:\Users\Admin\AppData\Roaming\Loader.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpDD54.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Loader.exe"C:\Users\Admin\AppData\Roaming\Loader.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Infected.exe"C:\Users\Admin\AppData\Local\Temp\Infected.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\Admin\AppData\Roaming\Loaader.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\Admin\AppData\Roaming\Loaader.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpDA96.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Loaader.exe"C:\Users\Admin\AppData\Roaming\Loaader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\WinDefend.exe"C:\Users\Admin\AppData\Local\Temp\WinDefend.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Client.exeFilesize
74KB
MD57ac0adf482250172280defec7a7054da
SHA120a25f0da68c309d062c4628ead8b6f377ac7969
SHA2563caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5
SHA512d03d033b931f3d39f95a1ec1cdc7d9014783f11b2438c265dd72c0bc34f9d5ced534a38c7c1c88ff930868fd9cf60521dd556b5c486c5cf364f798f39215a1aa
-
C:\Users\Admin\AppData\Local\Temp\Infected.exeFilesize
63KB
MD5b8d455465260a845db35492fda5a8888
SHA1287b0ba049ad8f3be802d2224efb86dba72d3221
SHA256a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282
SHA5125dba43ae31420de362593752e8ff491afbe8d20f183f6b95e6962ea1e637c7bf3bd50b5213e4d928a96b85d9b54841ee697798b0089624b13ef7eded826cd86a
-
C:\Users\Admin\AppData\Local\Temp\WinDefend.exeFilesize
87KB
MD55fc6a541845fdafb597ddfb98fa28b54
SHA122e5dd50ddd71bc39c812db0f9b164ca10c556dd
SHA25664e4dedb36812766c522c79cae57b7f3b2694efaa396151d4117a70282166117
SHA512f174e4ccc89d4a7473001a9153a9c3d63bedd393dda1ea3be171768b7587846722ad07445adeafa52ef54802a8ac84eb33ab1799248dcbf7db60aa4f311da5e3
-
C:\Users\Admin\AppData\Local\Temp\tmpDA96.tmp.batFilesize
151B
MD536fdc2977abe82cdb6acbfb28ed351f6
SHA1b93278f58bf19822b9c64c2b30d6e31aed6e0f58
SHA256b38b100f0e6624a515013e121e47a7282ff2897685337437389120d889e7c817
SHA512f637e759a52caf9d1bdaff7d8c7dc95f2594f16ae499dd10206f6a6da378e013e2a024cbf78cd679a53b1b7719e46b5ad01d47288535f7c10b2eff18da96f693
-
C:\Users\Admin\AppData\Local\Temp\tmpDD54.tmp.batFilesize
150B
MD517b66e734c7e4832382fc740ae650aa6
SHA171049d85d29145346c2b1cb792ee84951d5f54ed
SHA2560129c8c781f41446d4271e801c6018298c33f76702037835e486a07e435b3483
SHA512bd939b6ad34fdd61d6c6fc95e6f78b682b548b5e04442a5d458f6538378c73442f3f64d377987f33e6b95078c24beb49e850ede57436b5883426ef13f8c71cc0
-
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.confFilesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
C:\Users\Public\SSSS.logFilesize
2KB
MD5882fddf64ca46f8e9bd8f69a85037c14
SHA142054076dc71ba26812bc3e1d378bda72499bc50
SHA2567558b90ee2f2c698fb9ea0f7d6570596a456e4a3158e955a8ba976a9bd342c37
SHA512151e38e0a557bfc2ae8b968bbc56f95a0dbf566c0cdb702997f07eace90e17ef28e38a5b935250be28135cce9e2b790956f5c96c24003d5fc28824ecd4179e76
-
C:\Users\Public\SSSS.logFilesize
2KB
MD5efd26d9824e9f84f889419a3c31ddcd0
SHA10a913bbda233a73498ef13a6d92868b1a43df1a9
SHA2562ca3eb27dd822df82be15f25ad13ecbf3e5c8b629dcb2d871175cae9f4b097da
SHA5129e456e83222df653a41681568aea2e56ac7021f1af21ab3562580ac3c766351b72c575cbdb2e6753d6a3a9361657c8ae35ed9e9cb6b37b1a1c81774bc9b2de53
-
C:\Users\Public\SSSS.logFilesize
2KB
MD5f5d07ec02f1f32d8e5bfcd0c4eaeff9f
SHA15f50b2485249e528e38e4015748b9661a72f30b6
SHA256bc53ab351c817708eb1ca0a729bf4286c0d1a5aea4964353671f4ac5ecce64be
SHA512a16932fdb3313e97c8a8981b51c7b030d2a51a95f2565c8d19d8f92946854a21c8bd72f94056331b458a9eabb67f5d2d67d08883002783601d9cd2fc5d7931a6
-
C:\Users\Public\SSSS.logFilesize
2KB
MD5207998a89098d6eed78e5f5d97bbdcce
SHA1fa9623de697b5285895213ea76a83a824cb0a051
SHA2562bf842ee6ed07b14fbf5f1f1cbf0b61e17ee3fcb40c0fb292f930c330f8aa05a
SHA512f10f3fb90e62006636e70e86c579edea2c7fb52d0ba97babdb3e7b58b1522e0a554bc275e81a3e7e85485e1c01c836929b5be95d3880e507d060925c6fcb2593
-
C:\Users\Public\SSSS.logFilesize
3KB
MD525a6e0252eb5166350fe4264aeb72aa7
SHA10721d914aee30aefe33781277dbefdeee20aabaa
SHA256b08e881f0223afc691501e26aa56ffffb6031912791cf532597de7896fc9acf9
SHA512f432564a221313d6a10d2de68447d2a5079c3663edb10f9b5aee0fdfff02c6efdcb5daafc1f233a52012361e27be3f2495b4be8984e9e0f0c7e9ebbad530b72d
-
C:\Users\Public\SSSS.logFilesize
4KB
MD5672eabdc48b8764e8193cb1f49cbd006
SHA13dc8ad16bc943c86bae8758b2cbaddcd835f4e97
SHA256b3074bc273c78daa76f7a256197a82f05bdd28cf35b3a64c56f7d0e806319145
SHA512e9096922c18af0a0fba3fa1fd5a46974f23e79959de196136255119eb1a4352c4361dc50960d614d21a0ab5b392bf11055ed7bee3bb6f92a9712e14a009f853d
-
\??\PIPE\lsarpcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1332-16-0x0000000000290000-0x00000000002A6000-memory.dmpFilesize
88KB
-
memory/2084-7-0x00000000001B0000-0x00000000001C8000-memory.dmpFilesize
96KB
-
memory/2084-10-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmpFilesize
9.9MB
-
memory/2084-45-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmpFilesize
9.9MB
-
memory/2084-24-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmpFilesize
9.9MB
-
memory/2180-0-0x000007FEF5353000-0x000007FEF5354000-memory.dmpFilesize
4KB
-
memory/2180-1-0x0000000001120000-0x0000000001160000-memory.dmpFilesize
256KB
-
memory/2180-8-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmpFilesize
9.9MB
-
memory/2180-23-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmpFilesize
9.9MB
-
memory/2492-53-0x0000000001080000-0x0000000001098000-memory.dmpFilesize
96KB
-
memory/2828-52-0x0000000000D60000-0x0000000000D76000-memory.dmpFilesize
88KB
-
memory/2948-26-0x0000000000330000-0x0000000000336000-memory.dmpFilesize
24KB
-
memory/2948-25-0x0000000000F40000-0x0000000000F5E000-memory.dmpFilesize
120KB