b460cb71a7c6a0ef8f1f92dc52c237a41a783fa5d2925362eb0ab3db51420e71

Analysis

max time kernel
0s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
02-06-2024 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VenomRAT-V5.6-HVNC/ServerCertificate.p12
Size

1KB
MD5

6ce85262afbc028314bdf6fe9aa718a5
SHA1

b59fe71c2ebd80df9e3ba5681ff6e36c90c2f0a8
SHA256

74eba079b36c835cd89af395cf53272c53351cd851efb140a8152410c4e2973e
SHA512

8ac1198de48c3acab03482958ccd5044561599373338f0bb9ff203c0d596b810143d420ebdcb20abd60a1383a08e70f7ddac6fa9b304a0a3a61aa06af030e6fb

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

Processes:

mmc.exe

description ioc process

File opened for modification C:\Windows\system32\certmgr.msc mmc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\system32\certmgr.msc	mmc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

mmc.exe

description	pid	process
Token: 33	4376	mmc.exe
Token: SeIncBasePriorityPrivilege	4376	mmc.exe
Token: 33	4376	mmc.exe
Token: SeIncBasePriorityPrivilege	4376	mmc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

mmc.exe

pid process

4376 mmc.exe
4376 mmc.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

rundll32.exe

description pid process target process

PID 440 wrote to memory of 4376 440 rundll32.exe mmc.exe
PID 440 wrote to memory of 4376 440 rundll32.exe mmc.exe

pid	process
4376	mmc.exe
4376	mmc.exe

description	pid	process	target process
PID 440 wrote to memory of 4376	440	rundll32.exe	mmc.exe
PID 440 wrote to memory of 4376	440	rundll32.exe	mmc.exe

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX C:\Users\Admin\AppData\Local\Temp\VenomRAT-V5.6-HVNC\ServerCertificate.p12
1⤵
- Suspicious use of WriteProcessMemory
PID:440

C:\Windows\System32\mmc.exe
"C:\Windows\System32\mmc.exe" C:\Windows\system32\certmgr.msc /certmgr:FileName="C:\Users\Admin\AppData\Local\Temp\VenomRAT-V5.6-HVNC\ServerCertificate.p12"
2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4376

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads