Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2024 18:51
Behavioral task
behavioral1
Sample
7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
General
-
Target
7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe
-
Size
74KB
-
MD5
0af8749e1f482a9f97c9e4aefc5da420
-
SHA1
f7f7347c8a89c5ee6659aa8c545c5188a5924d74
-
SHA256
7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8
-
SHA512
071c05065a671b09cd61cc6e599903fdbcd73f1cc7866d9da2a2503249985743af01b0a8e5e897d7d2e37008cc795d04a7d936393336c172425cc9041c9987bf
-
SSDEEP
1536:iUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/8tM+uQzczUVclN:iUxcx4GfSPMV7e9VdQsH1bfEtGQWGY
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
127.0.0.1:4449
127.0.0.1:80
Mutex
uptzbkeaiphmrktdcms
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
resource yara_rule behavioral2/memory/4860-1-0x0000000000DE0000-0x0000000000DF8000-memory.dmp VenomRAT -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeIncreaseQuotaPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeSecurityPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeTakeOwnershipPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeLoadDriverPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeSystemProfilePrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeSystemtimePrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeProfSingleProcessPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeIncBasePriorityPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeCreatePagefilePrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeBackupPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeRestorePrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeShutdownPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeDebugPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeSystemEnvironmentPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeRemoteShutdownPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeUndockPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeManageVolumePrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: 33 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: 34 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: 35 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: 36 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeIncreaseQuotaPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeSecurityPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeTakeOwnershipPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeLoadDriverPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeSystemProfilePrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeSystemtimePrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeProfSingleProcessPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeIncBasePriorityPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeCreatePagefilePrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeBackupPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeRestorePrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeShutdownPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeDebugPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeSystemEnvironmentPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeRemoteShutdownPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeUndockPrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: SeManageVolumePrivilege 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: 33 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: 34 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: 35 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe Token: 36 4860 7ee2a9c30039cf2a4087285dd957bf4a3a9975972f7645a270348220b058e0f8.exe