Analysis
-
max time kernel
135s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2024 18:41
Behavioral task
behavioral1
Sample
3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe
-
Size
74KB
-
MD5
d1e14acc8e15993a0bc97536b210a689
-
SHA1
e5c971e6fa93812e96fe576b1f5e4dbb7f086669
-
SHA256
3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444
-
SHA512
ee54def6efe7a999a4f813240f1202fa78118b57e8582e3c4223a0710472fced495d3174000db888f714ffcbb6fc4f3cb4437639c7d69e9f1dbf9d87ea208ec5
-
SSDEEP
1536:lU1kcxEb44MCqSPMVTFZMiFIlH1bM/wPbb6hb5jQzckxLVclN:lUOcxEbzM9SPMVTFZMiKH1bM4TbEbBQy
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
WIndows Session Manager
C2
147.185.221.19:9999
Mutex
asdfrhdhnzevhenaz
Attributes
-
delay
2
-
install
true
-
install_file
WIndows Session Manager.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3004-1-0x00000000006C0000-0x00000000006D8000-memory.dmp VenomRAT -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exedescription pid Process Token: SeDebugPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeIncreaseQuotaPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSecurityPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeTakeOwnershipPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeLoadDriverPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSystemProfilePrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSystemtimePrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeProfSingleProcessPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeIncBasePriorityPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeCreatePagefilePrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeBackupPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeRestorePrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeShutdownPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeDebugPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSystemEnvironmentPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeRemoteShutdownPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeUndockPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeManageVolumePrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: 33 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: 34 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: 35 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: 36 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeIncreaseQuotaPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSecurityPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeTakeOwnershipPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeLoadDriverPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSystemProfilePrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSystemtimePrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeProfSingleProcessPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeIncBasePriorityPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeCreatePagefilePrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeBackupPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeRestorePrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeShutdownPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeDebugPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeSystemEnvironmentPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeRemoteShutdownPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeUndockPrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: SeManageVolumePrivilege 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: 33 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: 34 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: 35 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe Token: 36 3004 3ecd335862007c0a507c0c9426be4145ee8816b562fad2f80d585b0dd39cf444.exe