Analysis
-
max time kernel
71s -
max time network
71s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08-07-2024 09:53
Behavioral task
behavioral1
Sample
PanelexecutorV10.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
PanelexecutorV10.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
PanelexecutorV10.exe
-
Size
68KB
-
MD5
6ad64efc580e74ea69e039ed10607404
-
SHA1
03b67e5a02f5b3412132a5ac06e38115d95a4bb3
-
SHA256
363dbbb7542684ce9b5732337dc6356235c30bee1036822e36e52029acb5816c
-
SHA512
763ab3cbfe7e1d6a76a0dfcc0abf04fb403bd5db783395f6f6a99b07b8fe0da402f4f41faf82e7cc85bc7aee9b5964340387e8e94a2f9a4a621e3a687f46b1f0
-
SSDEEP
1536:FmptUOlV9tp0OKClGbbWwZGVI1YGqcDpqKmY7:sMOlj7xlGbbW1Lcgz
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
5.0.5
Botnet
Venom Clients
C2
127.0.0.1:4449
127.0.0.1:80
192.168.100.36:4449
192.168.100.36:80
Mutex
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
Attributes
-
delay
2
-
install
true
-
install_file
PanelExecutorV9.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2192 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1864 PanelexecutorV10.exe Token: SeSecurityPrivilege 1864 PanelexecutorV10.exe Token: SeTakeOwnershipPrivilege 1864 PanelexecutorV10.exe Token: SeLoadDriverPrivilege 1864 PanelexecutorV10.exe Token: SeSystemProfilePrivilege 1864 PanelexecutorV10.exe Token: SeSystemtimePrivilege 1864 PanelexecutorV10.exe Token: SeProfSingleProcessPrivilege 1864 PanelexecutorV10.exe Token: SeIncBasePriorityPrivilege 1864 PanelexecutorV10.exe Token: SeCreatePagefilePrivilege 1864 PanelexecutorV10.exe Token: SeBackupPrivilege 1864 PanelexecutorV10.exe Token: SeRestorePrivilege 1864 PanelexecutorV10.exe Token: SeShutdownPrivilege 1864 PanelexecutorV10.exe Token: SeDebugPrivilege 1864 PanelexecutorV10.exe Token: SeSystemEnvironmentPrivilege 1864 PanelexecutorV10.exe Token: SeRemoteShutdownPrivilege 1864 PanelexecutorV10.exe Token: SeUndockPrivilege 1864 PanelexecutorV10.exe Token: SeManageVolumePrivilege 1864 PanelexecutorV10.exe Token: 33 1864 PanelexecutorV10.exe Token: 34 1864 PanelexecutorV10.exe Token: 35 1864 PanelexecutorV10.exe Token: 36 1864 PanelexecutorV10.exe Token: SeDebugPrivilege 2192 taskmgr.exe Token: SeSystemProfilePrivilege 2192 taskmgr.exe Token: SeCreateGlobalPrivilege 2192 taskmgr.exe Token: 33 2192 taskmgr.exe Token: SeIncBasePriorityPrivilege 2192 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PanelexecutorV10.exe"C:\Users\Admin\AppData\Local\Temp\PanelexecutorV10.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2192