Analysis
-
max time kernel
127s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-10-2024 19:47
Behavioral task
behavioral1
Sample
7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.exe
Resource
win7-20240903-en
General
-
Target
7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.exe
-
Size
74KB
-
MD5
c68b658d7ad2d719d3eb54079f401944
-
SHA1
11308eb4ac8c2ae86249bc56e8a65368fe364be1
-
SHA256
7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91
-
SHA512
859679e490591b24549171780515a44bacaa7ad4beb59f6c3a7e65ba13ed57e4144542245b6073058ec35ae69a948c1e934e18fc6ae6cf550fa46a9ce09741f5
-
SSDEEP
1536:WUrQcxHCapCtGPMVCe9VdQuDI6H1bf/EigBQzciLVclN:WUMcxHCoeGPMVCe9VdQsH1bfPIQzBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
79.137.199.150:4449
srgopqzzquchkyq
-
delay
1
-
install
true
-
install_file
jkfghdhfd.exe
-
install_folder
%Temp%
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2440-1-0x0000000000850000-0x0000000000868000-memory.dmp VenomRAT C:\Users\Admin\AppData\Local\Temp\jkfghdhfd.exe VenomRAT behavioral1/memory/2260-18-0x0000000000190000-0x00000000001A8000-memory.dmp VenomRAT -
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jkfghdhfd.exe family_asyncrat -
Executes dropped EXE 1 IoCs
Processes:
jkfghdhfd.exepid process 2260 jkfghdhfd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2268 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.exejkfghdhfd.exepid process 2440 7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.exe 2440 7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.exe 2260 jkfghdhfd.exe 2260 jkfghdhfd.exe 2260 jkfghdhfd.exe 2260 jkfghdhfd.exe 2260 jkfghdhfd.exe 2260 jkfghdhfd.exe 2260 jkfghdhfd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.exejkfghdhfd.exedescription pid process Token: SeDebugPrivilege 2440 7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.exe Token: SeDebugPrivilege 2260 jkfghdhfd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
jkfghdhfd.exepid process 2260 jkfghdhfd.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.execmd.execmd.exedescription pid process target process PID 2440 wrote to memory of 2124 2440 7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.exe cmd.exe PID 2440 wrote to memory of 2124 2440 7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.exe cmd.exe PID 2440 wrote to memory of 2124 2440 7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.exe cmd.exe PID 2440 wrote to memory of 2104 2440 7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.exe cmd.exe PID 2440 wrote to memory of 2104 2440 7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.exe cmd.exe PID 2440 wrote to memory of 2104 2440 7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.exe cmd.exe PID 2124 wrote to memory of 1064 2124 cmd.exe schtasks.exe PID 2124 wrote to memory of 1064 2124 cmd.exe schtasks.exe PID 2124 wrote to memory of 1064 2124 cmd.exe schtasks.exe PID 2104 wrote to memory of 2268 2104 cmd.exe timeout.exe PID 2104 wrote to memory of 2268 2104 cmd.exe timeout.exe PID 2104 wrote to memory of 2268 2104 cmd.exe timeout.exe PID 2104 wrote to memory of 2260 2104 cmd.exe jkfghdhfd.exe PID 2104 wrote to memory of 2260 2104 cmd.exe jkfghdhfd.exe PID 2104 wrote to memory of 2260 2104 cmd.exe jkfghdhfd.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.exe"C:\Users\Admin\AppData\Local\Temp\7648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "jkfghdhfd" /tr '"C:\Users\Admin\AppData\Local\Temp\jkfghdhfd.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "jkfghdhfd" /tr '"C:\Users\Admin\AppData\Local\Temp\jkfghdhfd.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:1064 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8ED7.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\jkfghdhfd.exe"C:\Users\Admin\AppData\Local\Temp\jkfghdhfd.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5c68b658d7ad2d719d3eb54079f401944
SHA111308eb4ac8c2ae86249bc56e8a65368fe364be1
SHA2567648ce1a32114a9bc3aec7db4d7b1638a4792b22f3ecaeee6feafbc94e500e91
SHA512859679e490591b24549171780515a44bacaa7ad4beb59f6c3a7e65ba13ed57e4144542245b6073058ec35ae69a948c1e934e18fc6ae6cf550fa46a9ce09741f5
-
Filesize
156B
MD50debeed83fb42dc15642f63a3cd278bd
SHA17978231fc2a084846af33ffd08d4166fd64d99d1
SHA25623f25267b2fba16fbaae5bd4b90277b539f223a4031cbb48f529437ea04ce839
SHA5120f7b0a6b57c3dc1e640866c692bd87b74bf823c34c742bc90a7e68a0e8c89dad52395f774b75b40d24fbabd1112ca0f53a7d9671461ee7a48d0917d9ce19ad71
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b