Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2024 21:41
Behavioral task
behavioral1
Sample
1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe
Resource
win10v2004-20241007-en
General
-
Target
1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe
-
Size
140KB
-
MD5
b9fee407d70e83e291248d51bbbb8897
-
SHA1
e4927eeaf8d60746ecafece01e3b04fcd2943a22
-
SHA256
1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe
-
SHA512
3e728bc6dee46a524c51b1e4e8ef1f0d2ab114e25d09ea6b032b3811d3f7b695d3c726eb244d5bca7cee709cc4fb8263efa1003cc5e55ea16796340d5b469ab3
-
SSDEEP
3072:5vIco8BnecI3IcNNSb6pPI0q/JFOytRYQ:5FBw5obGQ0SJFOIv
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4724-1-0x0000000000BC0000-0x0000000000BE8000-memory.dmp VenomRAT -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exepid process 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exedescription pid process Token: SeDebugPrivilege 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exepid process 4724 1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe"C:\Users\Admin\AppData\Local\Temp\1384ba5e755cfac69b3badabaeae1dd922e30bf873556747ba4c7e903d426ffe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4724