Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
18/08/2024, 19:04
Behavioral task
behavioral1
Sample
db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
General
- Target db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe
- Size 74KB
- Sample240818-xq3cbssdrm
- SHA256 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d
- MD5 099e17dbdd5e270ba1108964878b02bf
- SHA1 6e36cb886f79b9bc15d65e63fda4e0bd4bb94a20
- SHA512 90c253f82a183fca9b3bfdf5ec06a1dca6d092978aa4132518bcd0a4d4706ea3b505d3af514737859ad481f8087733236cc592dcc7b0a94fa0bad289fc9199e8
- SSDEEP 1536:8UUPcxVteCW7PMVee9VdQuDI6H1bf/9N0nPXQzcBLVclN:8UmcxV4x7PMVee9VdQsH1bflN4QYBY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
-
Default
C2
-
127.0.0.1:4449
Mutex
-
szznovqkagrl
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
resource yara_rule behavioral2/memory/4484-1-0x00000000002E0000-0x00000000002F8000-memory.dmp VenomRAT - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4484 db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe"C:\Users\Admin\AppData\Local\Temp\db7cc62235cb2a0ad00f44edf682e2536d69a14d171ac583cd1402024ee0166d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4484