Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2024 21:41

General

  • Target

    1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe

  • Size

    140KB

  • MD5

    b9fee407d70e83e291248d51bbbb8897

  • SHA1

    e4927eeaf8d60746ecafece01e3b04fcd2943a22

  • SHA256

    1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe

  • SHA512

    3e728bc6dee46a524c51b1e4e8ef1f0d2ab114e25d09ea6b032b3811d3f7b695d3c726eb244d5bca7cee709cc4fb8263efa1003cc5e55ea16796340d5b469ab3

  • SSDEEP

    3072:5vIco8BnecI3IcNNSb6pPI0q/JFOytRYQ:5FBw5obGQ0SJFOIv

Score
10/10
rat

Malware Config

Signatures

  • VenomRAT 1 IoCs

    Detects VenomRAT.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe
    "C:\Users\Admin\AppData\Local\Temp\1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4724-0-0x00007FF827EC3000-0x00007FF827EC5000-memory.dmp

    Filesize

    8KB

  • memory/4724-1-0x0000000000BC0000-0x0000000000BE8000-memory.dmp

    Filesize

    160KB

  • memory/4724-3-0x00007FF827EC0000-0x00007FF828981000-memory.dmp

    Filesize

    10.8MB

  • memory/4724-4-0x00007FF827EC3000-0x00007FF827EC5000-memory.dmp

    Filesize

    8KB

  • memory/4724-5-0x00007FF827EC0000-0x00007FF828981000-memory.dmp

    Filesize

    10.8MB