Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 18:29
Behavioral task
behavioral1
Sample
0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe
-
Size
75KB
-
MD5
6a9f944ea6fc8e667a3f913a839e0f3d
-
SHA1
2ef7d6fbf2c8ceffd628821dbf2f79310d82063b
-
SHA256
0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963
-
SHA512
ca50af80e999602379ff70f66ccf041994b08f24b4cf5a492941f9d70d3610a09986fc1bb952d874a6aa57545db67614f8de74e1408f89332c04a15f5dc0e661
-
SSDEEP
1536:3Uzkcx4VHsC0SPMVEN2zObsMI2H1b4/m6y4cQzcwrVclN:3Uwcx4GfSPMVEN2zOb1H1b4uycQZhY
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
127.0.0.1:4449
194.59.31.28:4449
Mutex
xtlasaonnwment
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2980-1-0x0000000000020000-0x0000000000038000-memory.dmp VenomRAT -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exepid Process 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exedescription pid Process Token: SeDebugPrivilege 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exepid Process 2980 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe"C:\Users\Admin\AppData\Local\Temp\0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2980