Analysis
-
max time kernel
96s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2024 18:54
Behavioral task
behavioral1
Sample
a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
General
-
Target
a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe
-
Size
171KB
-
MD5
0509c3b133f0dd73e24659f34ee6dbbc
-
SHA1
0c24c13b1fdce37c0488a4dc56ce3217f52b75f9
-
SHA256
a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305
-
SHA512
91b4f0c449d7856464ca32e8881631d88dfd95333ba5217f77da7d8c28ecacb02ffc0d299a9c83a619fcda5cf1486d15b8817579c8f4a3ab27a27001bf5c0523
-
SSDEEP
3072:EEUOcxd1+bi+JpvlDFaLYxmk6GICPMw1qmSiVH1bffGwLUKKA8foBVaM8SKfbzx1:EEA1+bi+JpvlDULYxmk6GICPMw8mSsVD
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.2
Botnet
Default
C2
157.20.182.226:4449
Mutex
cmfpnygxzviiwhl
Attributes
-
delay
1
-
install
true
-
install_file
WinRAR.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
resource yara_rule behavioral2/memory/4624-1-0x0000000000D30000-0x0000000000D60000-memory.dmp VenomRAT -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeIncreaseQuotaPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeSecurityPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeTakeOwnershipPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeLoadDriverPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeSystemProfilePrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeSystemtimePrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeProfSingleProcessPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeIncBasePriorityPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeCreatePagefilePrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeBackupPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeRestorePrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeShutdownPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeDebugPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeSystemEnvironmentPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeRemoteShutdownPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeUndockPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeManageVolumePrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: 33 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: 34 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: 35 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: 36 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeIncreaseQuotaPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeSecurityPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeTakeOwnershipPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeLoadDriverPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeSystemProfilePrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeSystemtimePrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeProfSingleProcessPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeIncBasePriorityPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeCreatePagefilePrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeBackupPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeRestorePrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeShutdownPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeDebugPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeSystemEnvironmentPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeRemoteShutdownPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeUndockPrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: SeManageVolumePrivilege 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: 33 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: 34 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: 35 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe Token: 36 4624 a1c28eff889a732610b5b7f4a4f8464c3b58ef16227f617160df0753eda19305.exe