Analysis
- max time kernel
147s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system - submitted
08/07/2024, 17:52
Behavioral task
behavioral1
Sample
Brute XML-RPC WP/Revshow_x64 Unpacked.exe
Resource
win7-20240705-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
Brute XML-RPC WP/Revshow_x64 Unpacked.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
Brute XML-RPC WP/SSL_x64/vcredist_x64.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Brute XML-RPC WP/SSL_x64/vcredist_x64.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target Brute XML-RPC WP/Revshow_x64 Unpacked.exe
- Size 5.7MB
- Sample240708-wfn7aa1brp
- SHA256 c5c1908db7afd274f18e8e5fe57e1f60bcad32f4bf958ea00f31ad51f70d12e9
- MD5 867cb0f7c3b1ec55caa8d81085f61937
- SHA1 b1f5bc700996aef15c04ca568366941969142cf7
- SHA512 c061cd82854274ff7b76109749ef725d49ea0492c1f476efd7c6920ec607bb4e7d3ea9ac37f0fd2d0f91eac6f8bef074accd0bc0153409ab664bb81215b6c6bf
- SSDEEP 98304:l37EjgVv/wZXKaPBXsEuukm/ERkJeRs4/QFcQrCVvlkYpH9TeglQeRsXHY:lLE0VvYpNPuE7kmKLBQrCVdkYpdKgVR
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
-
Default
C2
-
171.233.98.70:18274
Mutex
-
mjexsfqtmzjvgyjtt
Attributes
-
delay
3
-
install
true
-
install_file
Registry.exe
-
install_folder
%AppData%
aes.plain
Signatures
- Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000800000002348e-16.dat family_asyncrat - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Control Panel\International\Geo\Nation Revshow_x64 Unpacked.exe - Executes dropped EXE 2 IoCs
pid Process 3928 revshow_x64 (2.12).exe 824 System.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\System.exe Revshow_x64 Unpacked.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe 3928 revshow_x64 (2.12).exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 824 System.exe Token: SeIncreaseQuotaPrivilege 824 System.exe Token: SeSecurityPrivilege 824 System.exe Token: SeTakeOwnershipPrivilege 824 System.exe Token: SeLoadDriverPrivilege 824 System.exe Token: SeSystemProfilePrivilege 824 System.exe Token: SeSystemtimePrivilege 824 System.exe Token: SeProfSingleProcessPrivilege 824 System.exe Token: SeIncBasePriorityPrivilege 824 System.exe Token: SeCreatePagefilePrivilege 824 System.exe Token: SeBackupPrivilege 824 System.exe Token: SeRestorePrivilege 824 System.exe Token: SeShutdownPrivilege 824 System.exe Token: SeDebugPrivilege 824 System.exe Token: SeSystemEnvironmentPrivilege 824 System.exe Token: SeRemoteShutdownPrivilege 824 System.exe Token: SeUndockPrivilege 824 System.exe Token: SeManageVolumePrivilege 824 System.exe Token: 33 824 System.exe Token: 34 824 System.exe Token: 35 824 System.exe Token: 36 824 System.exe Token: SeIncreaseQuotaPrivilege 824 System.exe Token: SeSecurityPrivilege 824 System.exe Token: SeTakeOwnershipPrivilege 824 System.exe Token: SeLoadDriverPrivilege 824 System.exe Token: SeSystemProfilePrivilege 824 System.exe Token: SeSystemtimePrivilege 824 System.exe Token: SeProfSingleProcessPrivilege 824 System.exe Token: SeIncBasePriorityPrivilege 824 System.exe Token: SeCreatePagefilePrivilege 824 System.exe Token: SeBackupPrivilege 824 System.exe Token: SeRestorePrivilege 824 System.exe Token: SeShutdownPrivilege 824 System.exe Token: SeDebugPrivilege 824 System.exe Token: SeSystemEnvironmentPrivilege 824 System.exe Token: SeRemoteShutdownPrivilege 824 System.exe Token: SeUndockPrivilege 824 System.exe Token: SeManageVolumePrivilege 824 System.exe Token: 33 824 System.exe Token: 34 824 System.exe Token: 35 824 System.exe Token: 36 824 System.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3928 revshow_x64 (2.12).exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1144 wrote to memory of 3928 1144 Revshow_x64 Unpacked.exe 84 PID 1144 wrote to memory of 3928 1144 Revshow_x64 Unpacked.exe 84 PID 1144 wrote to memory of 824 1144 Revshow_x64 Unpacked.exe 85 PID 1144 wrote to memory of 824 1144 Revshow_x64 Unpacked.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Brute XML-RPC WP\Revshow_x64 Unpacked.exe"C:\Users\Admin\AppData\Local\Temp\Brute XML-RPC WP\Revshow_x64 Unpacked.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\Brute XML-RPC WP\revshow_x64 (2.12).exe"C:\Users\Admin\AppData\Local\Temp\Brute XML-RPC WP\revshow_x64 (2.12).exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3928
-
-
C:\Windows\System.exe"C:\Windows\System.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:824
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Brute XML-RPC WP\revshow_x64 (2.12).exe
- Size 5.6MB
- SHA256 d02cec8f2a71aaba2cd1e86c92149e4ca26400a2219b59ff4503e5e1564f95ad
- MD5 0f31b9bbd8c4802b9d86307e2d00903f
- SHA1 3d7b661359e9caa0f77ba77c47c3d399902ad9e0
- SHA512 b0e6d5454547425f106c0c9f5fd7e87065ed8b5243423ba5f7aeae52c382d5a978ae697102374a6a103ff9462f0aafdbfdb3102ea586c9969bab139e5fde967f
- SSDEEP 49152:1dhiM29zp39LGj1oSm90el2kJn9H8SwEUbFSgBbPpTsRYDgDnkQR/t:1OF9/ie8CUz+1t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System.exe
- Size 74KB
- SHA256 baeb775d18945731172380ad0c63469b15824b22400d5865723b134db3378346
- MD5 caf2c7139bd1b5295ae3e1fdb0f34ba9
- SHA1 7fbcc4e7508a425a3921a88691f3870a8d9cbdf6
- SHA512 24c6ba1a648b14ccbf0a46005e649cd74e8e557cb0e019a603e021a543d454e7d643afb809e568d96b7b272356067036dad12827fab88be55b2ba25e2bebf24e
- SSDEEP 1536:SU6Acx2l/Cx2PMVie9VdQuDIqH1bd/kbPQzcuLVclN:SUjcx2Bq2PMVie9VdQ4H1bd+PQnBY
- MD5 SHA1 SHA512 SSDEEP