Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
18/08/2024, 18:53
Behavioral task
behavioral1
Sample
97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
General
- Target 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe
- Size 74KB
- Sample240818-xj4ltasank
- SHA256 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77
- MD5 4dd8ee01f81074edc2a11e4dbc305bee
- SHA1 9a9b9c414c17dcad030138730c2c207035abfc86
- SHA512 267aa1043c43d4f32549d26172c0cf6ac92e7a5c38a01969801a729d350c46caf586a62b9dad944c5f4f56df4625257c6f5bc47487c6dc4565fe3c6800c014aa
- SSDEEP 1536:8UUPcxVteCW7PMVee9VdQuDI6H1bf/madNydQzcBLVclN:8UmcxV4x7PMVee9VdQsH1bf78QYBY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
-
Default
C2
-
127.0.0.1:4449
Mutex
-
gkzkbmmbiwgp
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
resource yara_rule behavioral2/memory/3488-1-0x0000000000BB0000-0x0000000000BC8000-memory.dmp VenomRAT - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe Token: SeDebugPrivilege 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3488 97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe"C:\Users\Admin\AppData\Local\Temp\97734d6c98daa5a61c73189de3a38e8b2d2bf8fdfce0c8b25383d11510717f77.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3488