Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
18/08/2024, 18:29
Behavioral task
behavioral1
Sample
0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
General
- Target 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe
- Size 75KB
- Sample240818-w47njaxejd
- SHA256 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963
- MD5 6a9f944ea6fc8e667a3f913a839e0f3d
- SHA1 2ef7d6fbf2c8ceffd628821dbf2f79310d82063b
- SHA512 ca50af80e999602379ff70f66ccf041994b08f24b4cf5a492941f9d70d3610a09986fc1bb952d874a6aa57545db67614f8de74e1408f89332c04a15f5dc0e661
- SSDEEP 1536:3Uzkcx4VHsC0SPMVEN2zObsMI2H1b4/m6y4cQzcwrVclN:3Uwcx4GfSPMVEN2zOb1H1b4uycQZhY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
-
Default
C2
-
127.0.0.1:4449
-
194.59.31.28:4449
Mutex
-
xtlasaonnwment
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
resource yara_rule behavioral2/memory/2244-1-0x0000000000CE0000-0x0000000000CF8000-memory.dmp VenomRAT - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2244 0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe"C:\Users\Admin\AppData\Local\Temp\0fdd77bb55af1ad0e51dd6bba89b955b6be6488bc9f8ff62a5ba13c551cc1963.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2244