Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 18:41
Behavioral task
behavioral1
Sample
3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe
-
Size
74KB
-
MD5
d1e14acc8e15993a0bc97536b210a689
-
SHA1
e5c971e6fa93812e96fe576b1f5e4dbb7f086669
-
SHA256
3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444
-
SHA512
ee54def6efe7a999a4f813240f1202fa78118b57e8582e3c4223a0710472fced495d3174000db888f714ffcbb6fc4f3cb4437639c7d69e9f1dbf9d87ea208ec5
-
SSDEEP
1536:lU1kcxEb44MCqSPMVTFZMiFIlH1bM/wPbb6hb5jQzckxLVclN:lUOcxEbzM9SPMVTFZMiKH1bM4TbEbBQy
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
WIndows Session Manager
C2
147.185.221.19:9999
Mutex
asdfrhdhnzevhenaz
Attributes
-
delay
2
-
install
true
-
install_file
WIndows Session Manager.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1640-1-0x0000000000CD0000-0x0000000000CE8000-memory.dmp VenomRAT -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exedescription pid Process Token: SeDebugPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeIncreaseQuotaPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSecurityPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeTakeOwnershipPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeLoadDriverPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSystemProfilePrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSystemtimePrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeProfSingleProcessPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeIncBasePriorityPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeCreatePagefilePrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeBackupPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeRestorePrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeShutdownPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeDebugPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSystemEnvironmentPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeRemoteShutdownPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeUndockPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeManageVolumePrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: 33 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: 34 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: 35 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeIncreaseQuotaPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSecurityPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeTakeOwnershipPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeLoadDriverPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSystemProfilePrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSystemtimePrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeProfSingleProcessPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeIncBasePriorityPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeCreatePagefilePrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeBackupPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeRestorePrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeShutdownPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeDebugPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSystemEnvironmentPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeRemoteShutdownPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeUndockPrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeManageVolumePrivilege 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: 33 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: 34 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: 35 1640 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe