Analysis
-
max time kernel
139s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-06-2024 06:15
Behavioral task
behavioral1
Sample
Venus Tool.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Venus Tool.exe
Resource
win10v2004-20240226-en
General
-
Target
Venus Tool.exe
-
Size
5.9MB
-
MD5
4238a832dbee926a3888e4ca18c9bff8
-
SHA1
3d1a7c8a85b33f7b71b6e3cd608c70b5fa19b07d
-
SHA256
88c11f9c63b5ab1f0e479c6d0fce5f9262496f7b76a918256181b677451909e3
-
SHA512
81fec5d57208a7f49dd3fed769841709e8ad890d277e1b6ee83b36c93608df18d8577bd7e61915d60f2c01aa3467ff5c36501a8fba4c85d9cbfdb48783663690
-
SSDEEP
98304:rN+nhjdRai65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeFl9hikrK0ZM:rAnpIDOYjJlpZstQoS9Hf12VKX6biCGV
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Venus Tool.exepid process 3052 Venus Tool.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI12802\python310.dll upx -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
taskmgr.exepid process 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 2408 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 2408 taskmgr.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
Processes:
taskmgr.exepid process 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe -
Suspicious use of SendNotifyMessage 52 IoCs
Processes:
taskmgr.exepid process 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe 2408 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Venus Tool.exedescription pid process target process PID 1280 wrote to memory of 3052 1280 Venus Tool.exe Venus Tool.exe PID 1280 wrote to memory of 3052 1280 Venus Tool.exe Venus Tool.exe PID 1280 wrote to memory of 3052 1280 Venus Tool.exe Venus Tool.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Venus Tool.exe"C:\Users\Admin\AppData\Local\Temp\Venus Tool.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\Venus Tool.exe"C:\Users\Admin\AppData\Local\Temp\Venus Tool.exe"2⤵
- Loads dropped DLL
PID:3052
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2408
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI12802\python310.dllFilesize
1.4MB
MD5b93eda8cc111a5bde906505224b717c3
SHA15f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e
SHA256efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983
SHA512b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba
-
memory/2408-45-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2408-46-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2408-47-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2408-48-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/3052-23-0x000007FEF5FE0000-0x000007FEF6445000-memory.dmpFilesize
4.4MB
-
memory/3052-24-0x000007FEF5FE0000-0x000007FEF6445000-memory.dmpFilesize
4.4MB