Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2024 18:39
Behavioral task
behavioral1
Sample
2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe
-
Size
74KB
-
MD5
b2488a5e78b957f37b70b9218a7a6412
-
SHA1
9a77e7f37f8eccd6e13aaec4c72440bc13f5c2d2
-
SHA256
2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53
-
SHA512
0469f7b4996492aa6777747b194cb3bfcf77111d202f640c66d947b8ad1fdeb384d2b309e5538790c843660273e68038cb171f5b7eab22b8afa9159386fb9115
-
SSDEEP
1536:/UD0cxVGlCBiPMVyojaIWH1bD/5RxQzcKLVclN:/UAcxVMWiPMVjjyH1bDRRxQ7BY
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
194.59.31.28:4449
127.0.0.1:4449
Mutex
plhqiypkablfjrmqa
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1892-1-0x0000000000E20000-0x0000000000E38000-memory.dmp VenomRAT -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exepid Process 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exedescription pid Process Token: SeDebugPrivilege 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exepid Process 1892 2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe"C:\Users\Admin\AppData\Local\Temp\2e12f44f2b74c18420379eb92146b22aef1014ba8e444ec9efe6db2d16531e53.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1892