Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-10-2024 21:30
Behavioral task
behavioral1
Sample
2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exe
Resource
win7-20240903-en
General
-
Target
2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exe
-
Size
74KB
-
MD5
6245024bd7965b1bb284f757884f12bb
-
SHA1
00ee4ce63997cf724ba0548f84723b58cdab7d4c
-
SHA256
2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85
-
SHA512
58d6f0e2f32086307112300ae3493ea8d81429c5ced355c0cc3f2d2115db32c2f0cd085cfee5d5ef83d34fc5353348aa6a3b57e468ad8723219ea1198c868935
-
SSDEEP
1536:pUhgcxnj3CuWPMVjYOUqiWyIJH1b8/VIM72QzcGLVclN:pU+cxnL1WPMVjYOUqL1H1b89f2QfBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Wifi
prfqgcbkhfyyvkp
-
delay
1
-
install
true
-
install_file
System32.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/x5dAqXRm
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2384-1-0x00000000002B0000-0x00000000002C8000-memory.dmp VenomRAT C:\Users\Admin\AppData\Roaming\System32.exe VenomRAT behavioral1/memory/2716-18-0x0000000000230000-0x0000000000248000-memory.dmp VenomRAT -
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\System32.exe family_asyncrat -
Executes dropped EXE 1 IoCs
Processes:
System32.exepid process 2716 System32.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2576 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exeSystem32.exepid process 2384 2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exe 2384 2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exe 2384 2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe 2716 System32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exeSystem32.exedescription pid process Token: SeDebugPrivilege 2384 2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exe Token: SeDebugPrivilege 2384 2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exe Token: SeDebugPrivilege 2716 System32.exe Token: SeDebugPrivilege 2716 System32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
System32.exepid process 2716 System32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.execmd.execmd.exedescription pid process target process PID 2384 wrote to memory of 2780 2384 2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exe cmd.exe PID 2384 wrote to memory of 2780 2384 2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exe cmd.exe PID 2384 wrote to memory of 2780 2384 2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exe cmd.exe PID 2384 wrote to memory of 2696 2384 2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exe cmd.exe PID 2384 wrote to memory of 2696 2384 2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exe cmd.exe PID 2384 wrote to memory of 2696 2384 2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exe cmd.exe PID 2696 wrote to memory of 2576 2696 cmd.exe timeout.exe PID 2696 wrote to memory of 2576 2696 cmd.exe timeout.exe PID 2696 wrote to memory of 2576 2696 cmd.exe timeout.exe PID 2780 wrote to memory of 2848 2780 cmd.exe schtasks.exe PID 2780 wrote to memory of 2848 2780 cmd.exe schtasks.exe PID 2780 wrote to memory of 2848 2780 cmd.exe schtasks.exe PID 2696 wrote to memory of 2716 2696 cmd.exe System32.exe PID 2696 wrote to memory of 2716 2696 cmd.exe System32.exe PID 2696 wrote to memory of 2716 2696 cmd.exe System32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exe"C:\Users\Admin\AppData\Local\Temp\2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "System32" /tr '"C:\Users\Admin\AppData\Roaming\System32.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "System32" /tr '"C:\Users\Admin\AppData\Roaming\System32.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:2848 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF69E.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2576 -
C:\Users\Admin\AppData\Roaming\System32.exe"C:\Users\Admin\AppData\Roaming\System32.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5814c441d9e64c9db2045eb4db4fda84d
SHA101533ceea42f69fe3bd07008e11f50a80caf74bb
SHA2568f54dcbd10f415c9763a8c44d7b965033eba5f59d0c78e34b40e7cd235fd2fcd
SHA512f4c9acf1a82dd0b319016b1128be940b513112e7e32286079e4a277791b0394e6885d0067e2095bde3efbc024376deef2f61bfc41035c889d726d2213bdc3100
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
74KB
MD56245024bd7965b1bb284f757884f12bb
SHA100ee4ce63997cf724ba0548f84723b58cdab7d4c
SHA2562d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85
SHA51258d6f0e2f32086307112300ae3493ea8d81429c5ced355c0cc3f2d2115db32c2f0cd085cfee5d5ef83d34fc5353348aa6a3b57e468ad8723219ea1198c868935