Analysis
-
max time kernel
130s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-10-2024 21:41
Behavioral task
behavioral1
Sample
1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe
Resource
win10v2004-20241007-en
General
-
Target
1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe
-
Size
140KB
-
MD5
b9fee407d70e83e291248d51bbbb8897
-
SHA1
e4927eeaf8d60746ecafece01e3b04fcd2943a22
-
SHA256
1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe
-
SHA512
3e728bc6dee46a524c51b1e4e8ef1f0d2ab114e25d09ea6b032b3811d3f7b695d3c726eb244d5bca7cee709cc4fb8263efa1003cc5e55ea16796340d5b469ab3
-
SSDEEP
3072:5vIco8BnecI3IcNNSb6pPI0q/JFOytRYQ:5FBw5obGQ0SJFOIv
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2148-1-0x0000000000F60000-0x0000000000F88000-memory.dmp VenomRAT -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exepid process 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exedescription pid process Token: SeDebugPrivilege 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exepid process 2148 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe"C:\Users\Admin\AppData\Local\Temp\1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2148