46c17ffefbfcaa044cbbcbb33d6219da84538c22a51e53bff647c87da33a0bd9 | Triage

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2024 02:08

Sharing

Report Analysis Logs

General

Target

VenomRAT.v6.0.3.+SOURCE.7z
Size

73.7MB
MD5

29c6c293c6723135cbe7b5d0fc3a3d20
SHA1

17219c8998c1afa1bd7061276958e9ed54cbb393
SHA256

46c17ffefbfcaa044cbbcbb33d6219da84538c22a51e53bff647c87da33a0bd9
SHA512

d6833432820b6eb2828ffd88a3028f3b3b014176db76330ce5c3af5eeb80aac1d9816d81dfdaa11a972e59ed144551d60c1cf4b0568e5cc7dedcb6df033c12e1
SSDEEP

1572864:4VI5gzIBQ4OZRbwhtq81vZ8KCNsuYk+8327i8Nd5Sr5:KIeIa4Atotq87BCyuz+BOKe5

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 1328 7zFM.exe
Token: 35 1328 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

1328 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\VenomRAT.v6.0.3.+SOURCE.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads