Overview
overview
10Static
static
10VenomRAT v...CE).7z
windows11-21h2-x64
10VenomRAT v...to.dll
windows11-21h2-x64
1VenomRAT v...nt.exe
windows11-21h2-x64
10VenomRAT v...re.dll
windows11-21h2-x64
1VenomRAT v....2.dll
windows11-21h2-x64
1VenomRAT v....1.dll
windows11-21h2-x64
1VenomRAT v....2.dll
windows11-21h2-x64
1VenomRAT v....1.dll
windows11-21h2-x64
1VenomRAT v....2.dll
windows11-21h2-x64
1VenomRAT v...UI.dll
windows11-21h2-x64
1Analysis
- max time kernel
1782s - max time network
1806s - platform
windows11-21h2_x64 - resource
win11-20240611-en - resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system - submitted
29/06/2024, 00:45
Behavioral task
behavioral1
Sample
VenomRAT v6.0.3 (+SOURCE).7z
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
VenomRAT v6.0.3 (+SOURCE)/VenomRAT v6.0.3 (SOURCE)/BouncyCastle.Crypto.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
VenomRAT v6.0.3 (+SOURCE)/VenomRAT v6.0.3 (SOURCE)/Client.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
VenomRAT v6.0.3 (+SOURCE)/VenomRAT v6.0.3 (SOURCE)/DevExpress.Charts.v22.2.Core.dll
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
VenomRAT v6.0.3 (+SOURCE)/VenomRAT v6.0.3 (SOURCE)/DevExpress.CodeParser.v22.2.dll
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
VenomRAT v6.0.3 (+SOURCE)/VenomRAT v6.0.3 (SOURCE)/DevExpress.Data.Desktop.v22.1.dll
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
VenomRAT v6.0.3 (+SOURCE)/VenomRAT v6.0.3 (SOURCE)/DevExpress.Data.Desktop.v22.2.dll
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
VenomRAT v6.0.3 (+SOURCE)/VenomRAT v6.0.3 (SOURCE)/DevExpress.Data.v22.1.dll
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
VenomRAT v6.0.3 (+SOURCE)/VenomRAT v6.0.3 (SOURCE)/DevExpress.Data.v22.2.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
VenomRAT v6.0.3 (+SOURCE)/VenomRAT v6.0.3 (SOURCE)/DevExpress.DataAccess.v22.2.UI.dll
Resource
win11-20240611-en
windows11-21h2-x64
General
- Target VenomRAT v6.0.3 (+SOURCE)/VenomRAT v6.0.3 (SOURCE)/Client.exe
- Size 66KB
- Sample240629-a341cswgqa
- SHA256 3a7efdc3d85adf7a5484ef17549db47be2a78b4b6892d93dd91958bb9a9edb82
- MD5 3935ef8202cd8040741138a14b0655f0
- SHA1 54cf02cf472111b57ac5329a408b2f858e2f3b86
- SHA512 cbc24bde07ec9d1372869ce697ba3fcc76a7be2b75122af1f283160551dfc2dd18f77bc24ed0fff37b49dc7c8b0ffd41001f238595bec0c4761a5f4a79ec5ff1
- SSDEEP 1536:0vWMO7xoQlzh4fZF9O8QQHFkYlTwVsbbXA/a2s9TDZVclN:HoR9O8QQHFk1sbbXh2sNzY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
asyncrat
-
1.0.7
-
Default
-
95.216.52.21:7575
-
xdnqiaxygefjfoolgo
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe 1372 Client.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1372 Client.exe