Analysis
-
max time kernel
142s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2024 18:37
Behavioral task
behavioral1
Sample
2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
General
-
Target
2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe
-
Size
88KB
-
MD5
5e25726a99da275e37eecbb87708529e
-
SHA1
366218c3aac3eb6077c128ed9b8753a28deec857
-
SHA256
2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190
-
SHA512
308d1acf87bde009c45b928ea318e61f0aa507ee7a7c54cce55fd1abe94437d12d59aaa7abd5e8bd5b1a483cc39ac62ee32a2b270a4a755d49fb2667802c88f0
-
SSDEEP
1536:eUckcxw+/9CZSPMVae9VdQuDI6H1bf/4LPQQzctLVclN:eUpcxw+1uSPMVae9VdQsH1bfAjQQgBY
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
171.233.98.70:18274
Mutex
douhgmolozhnapqdo
Attributes
-
delay
1
-
install
true
-
install_file
Registry.exe
-
install_folder
%systemroot%
aes.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3000-1-0x0000000000B50000-0x000000000147E000-memory.dmp VenomRAT -
Processes:
resource yara_rule behavioral2/memory/3000-1-0x0000000000B50000-0x000000000147E000-memory.dmp themida -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exedescription pid Process Token: SeDebugPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeIncreaseQuotaPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeSecurityPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeTakeOwnershipPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeLoadDriverPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeSystemProfilePrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeSystemtimePrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeProfSingleProcessPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeIncBasePriorityPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeCreatePagefilePrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeBackupPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeRestorePrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeShutdownPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeDebugPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeSystemEnvironmentPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeRemoteShutdownPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeUndockPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeManageVolumePrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: 33 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: 34 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: 35 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: 36 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeIncreaseQuotaPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeSecurityPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeTakeOwnershipPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeLoadDriverPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeSystemProfilePrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeSystemtimePrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeProfSingleProcessPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeIncBasePriorityPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeCreatePagefilePrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeBackupPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeRestorePrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeShutdownPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeDebugPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeSystemEnvironmentPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeRemoteShutdownPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeUndockPrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: SeManageVolumePrivilege 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: 33 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: 34 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: 35 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe Token: 36 3000 2a468d20b8c63c210a8c991c8d745bc7fd89a75dec4680f47bd0afd4d8a6f190.exe