Analysis
-
max time kernel
134s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2024 18:48
Behavioral task
behavioral1
Sample
719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
General
-
Target
719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe
-
Size
111KB
-
MD5
081d1441bb23508962fe1b5e35a08aea
-
SHA1
b9e15824cf5523eabcdd9eb6328ebf1793dc81c1
-
SHA256
719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290
-
SHA512
6f6b5aa71ec0b04941fb540d9fd070fdd651c67e9c545cf623f52e1486bdad26ff5b2af3c59df9eaa5cc930b0c5e05f1b3c8c268b6a17d088d2b150d7c355bd4
-
SSDEEP
3072:ZUTcxMmw6PMV2e9VdQsH1bf5oQEA2QtDud7r6GiX8QiQ//fY:Zjw6PMV2aesVbxoZA2eDudr6SEf
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
127.0.0.1:4449
127.0.0.1:8080
193.233.255.79:4449
193.233.255.79:8080
Mutex
53263126231
Attributes
-
delay
1
-
install
true
-
install_file
42165.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
resource yara_rule behavioral2/memory/2432-1-0x0000000000B90000-0x0000000000BB2000-memory.dmp VenomRAT -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeIncreaseQuotaPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeSecurityPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeTakeOwnershipPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeLoadDriverPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeSystemProfilePrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeSystemtimePrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeProfSingleProcessPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeIncBasePriorityPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeCreatePagefilePrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeBackupPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeRestorePrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeShutdownPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeDebugPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeSystemEnvironmentPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeRemoteShutdownPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeUndockPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeManageVolumePrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: 33 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: 34 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: 35 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: 36 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeIncreaseQuotaPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeSecurityPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeTakeOwnershipPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeLoadDriverPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeSystemProfilePrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeSystemtimePrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeProfSingleProcessPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeIncBasePriorityPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeCreatePagefilePrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeBackupPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeRestorePrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeShutdownPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeDebugPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeSystemEnvironmentPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeRemoteShutdownPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeUndockPrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: SeManageVolumePrivilege 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: 33 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: 34 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: 35 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe Token: 36 2432 719926d5661d42e41d116bf9d2b864f361c99214da2cd1f67becc2f925953290.exe