Analysis
-
max time kernel
117s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-10-2024 16:30
Behavioral task
behavioral1
Sample
b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exe
Resource
win7-20240903-en
General
-
Target
b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exe
-
Size
74KB
-
MD5
d31670507197670c37d81c457795afb0
-
SHA1
338955eaf9b4b052f016a2b75b7a06ecb9c81f72
-
SHA256
b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397b
-
SHA512
cc5eb799040fb5f1d099e1c280f47297ea470a2e117aab5c4115b540f74f78f4ab654505632e3b8b716051619bfda513df4b951b237cdf7b756ff37509e80a8f
-
SSDEEP
1536:sU6Acx2l/Cx2PMVie9VdQuDI6H1bf/L60ZKYXgQzciiVclN:sUjcx2Bq2PMVie9VdQsH1bfT6oKYXgQH
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
127.0.0.1:4449
127.0.0.1:0
heherherheheheherherh
-
delay
1
-
install
true
-
install_file
explorer.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Processes:
resource yara_rule behavioral1/memory/2848-1-0x0000000001360000-0x0000000001378000-memory.dmp VenomRAT C:\Users\Admin\AppData\Roaming\explorer.exe VenomRAT behavioral1/memory/2888-18-0x0000000000EA0000-0x0000000000EB8000-memory.dmp VenomRAT -
Venomrat family
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\explorer.exe family_asyncrat -
Executes dropped EXE 1 IoCs
Processes:
explorer.exepid process 2888 explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2564 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exeexplorer.exepid process 2848 b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exe 2848 b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exe 2848 b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2848 b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exe Token: SeDebugPrivilege 2888 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid process 2888 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.execmd.execmd.exedescription pid process target process PID 2848 wrote to memory of 2700 2848 b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exe cmd.exe PID 2848 wrote to memory of 2700 2848 b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exe cmd.exe PID 2848 wrote to memory of 2700 2848 b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exe cmd.exe PID 2848 wrote to memory of 2772 2848 b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exe cmd.exe PID 2848 wrote to memory of 2772 2848 b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exe cmd.exe PID 2848 wrote to memory of 2772 2848 b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exe cmd.exe PID 2772 wrote to memory of 2564 2772 cmd.exe timeout.exe PID 2772 wrote to memory of 2564 2772 cmd.exe timeout.exe PID 2772 wrote to memory of 2564 2772 cmd.exe timeout.exe PID 2700 wrote to memory of 2280 2700 cmd.exe schtasks.exe PID 2700 wrote to memory of 2280 2700 cmd.exe schtasks.exe PID 2700 wrote to memory of 2280 2700 cmd.exe schtasks.exe PID 2772 wrote to memory of 2888 2772 cmd.exe explorer.exe PID 2772 wrote to memory of 2888 2772 cmd.exe explorer.exe PID 2772 wrote to memory of 2888 2772 cmd.exe explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exe"C:\Users\Admin\AppData\Local\Temp\b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397bN.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "explorer" /tr '"C:\Users\Admin\AppData\Roaming\explorer.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "explorer" /tr '"C:\Users\Admin\AppData\Roaming\explorer.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:2280 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpE57F.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2564 -
C:\Users\Admin\AppData\Roaming\explorer.exe"C:\Users\Admin\AppData\Roaming\explorer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a44c5772406571931e0f6b489dc7bb95
SHA18267d80e24072abc579c1a06e4006c328e8b63e6
SHA2562434b6720f49b4a22d6c020641cf1be19cb513410fc075ada423dbde24bd8f08
SHA51207725a6a09544e1f4e6c2cc91d0f66d4c25cc709fc8598e0b9d310e76346f6493905eaf9682b2b033a1d0fb267ad1bb9ba270034d793f9cf8822381152609ec4
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
74KB
MD5d31670507197670c37d81c457795afb0
SHA1338955eaf9b4b052f016a2b75b7a06ecb9c81f72
SHA256b62a8e8bbadf678bf9e62626feb5e33b298ab440102762f67948a487bfe4397b
SHA512cc5eb799040fb5f1d099e1c280f47297ea470a2e117aab5c4115b540f74f78f4ab654505632e3b8b716051619bfda513df4b951b237cdf7b756ff37509e80a8f