Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 18:36
Behavioral task
behavioral1
Sample
296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
General
-
Target
296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe
-
Size
74KB
-
MD5
32b65e6e0e6112b5dae6b43f214c28f6
-
SHA1
8c268ab559f6cce631c9da6949cc7c2d4abced08
-
SHA256
296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6
-
SHA512
c670f08f60bf3934817f842539a2dc3534c2503234892f4ec3d4809e4ab88624810dbca7c31002d5c2c900145d7fe5db7727746268bdcefd36a893cf11606a07
-
SSDEEP
1536:uUme0cxFVTuCGbPMVOe9VdQuDI6H1bf/JvQzc+LVclN:uUm3cxFVaBbPMVOe9VdQsH1bfhQXBY
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
127.0.0.1:4449
Mutex
lol.exe
Attributes
-
delay
1
-
install
true
-
install_file
lol.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1848-1-0x0000000000BF0000-0x0000000000C08000-memory.dmp VenomRAT -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exedescription pid Process Token: SeDebugPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeIncreaseQuotaPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeSecurityPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeTakeOwnershipPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeLoadDriverPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeSystemProfilePrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeSystemtimePrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeProfSingleProcessPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeIncBasePriorityPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeCreatePagefilePrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeBackupPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeRestorePrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeShutdownPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeDebugPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeSystemEnvironmentPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeRemoteShutdownPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeUndockPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeManageVolumePrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: 33 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: 34 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: 35 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeIncreaseQuotaPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeSecurityPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeTakeOwnershipPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeLoadDriverPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeSystemProfilePrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeSystemtimePrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeProfSingleProcessPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeIncBasePriorityPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeCreatePagefilePrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeBackupPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeRestorePrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeShutdownPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeDebugPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeSystemEnvironmentPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeRemoteShutdownPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeUndockPrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: SeManageVolumePrivilege 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: 33 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: 34 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe Token: 35 1848 296674e268379a496e66b4e571881c32e75e46e661aa7247405201a126a782c6.exe