Analysis
- max time kernel
96s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
05/08/2024, 17:22
Behavioral task
behavioral1
Sample
b6b2fb722cd971de816fc175a5fcf280N.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
120 seconds
General
- Target b6b2fb722cd971de816fc175a5fcf280N.exe
- Size 82KB
- Sample240805-vx2m9ssgnp
- SHA256 d6dee58b84725522ff3c9ee5a38852f5b19ea330f61a55632dfa0eb4de78fdab
- MD5 b6b2fb722cd971de816fc175a5fcf280
- SHA1 284030df31f941eb6d24a4d99afd3c9e8318d4b8
- SHA512 8fe5038d25b68538da5ff71825aece45d4252e59b949e00e38bf2624d98d944d57f87347f436ff2364df913cf422c6258ceeece0ee2e72fb951dbc8d65121d3f
- SSDEEP 1536:BNUEkcx4VHsC0SPMVBX4AAIvH1bx/QziQzcd33oLVclN:rUxcx4GfSPMV/pH1bxJQg33oBY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
-
Default
C2
-
127.0.0.1:4449
Mutex
-
qfnvtuedpjgnsylirpz
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
resource yara_rule behavioral2/memory/4572-0-0x00000000009D0000-0x00000000009EA000-memory.dmp VenomRAT - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeIncreaseQuotaPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeSecurityPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeTakeOwnershipPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeLoadDriverPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeSystemProfilePrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeSystemtimePrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeProfSingleProcessPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeIncBasePriorityPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeCreatePagefilePrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeBackupPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeRestorePrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeShutdownPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeDebugPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeSystemEnvironmentPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeRemoteShutdownPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeUndockPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeManageVolumePrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: 33 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: 34 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: 35 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: 36 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeIncreaseQuotaPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeSecurityPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeTakeOwnershipPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeLoadDriverPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeSystemProfilePrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeSystemtimePrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeProfSingleProcessPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeIncBasePriorityPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeCreatePagefilePrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeBackupPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeRestorePrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeShutdownPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeDebugPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeSystemEnvironmentPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeRemoteShutdownPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeUndockPrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: SeManageVolumePrivilege 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: 33 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: 34 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: 35 4572 b6b2fb722cd971de816fc175a5fcf280N.exe Token: 36 4572 b6b2fb722cd971de816fc175a5fcf280N.exe