Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-11-2024 16:51
Static task
static1
Behavioral task
behavioral1
Sample
1.msi
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1.msi
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
URFT06GSBAWRP_001_PDF.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
URFT06GSBAWRP_001_PDF.exe
Resource
win10v2004-20241007-en
General
-
Target
URFT06GSBAWRP_001_PDF.exe
-
Size
300.0MB
-
MD5
464753cd8a6523de0fba921ce6846177
-
SHA1
6b3b77af1129f9ad86acc31163d8450eacb4dbd3
-
SHA256
3221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092
-
SHA512
589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2
-
SSDEEP
3072:1iJZ3k2p8jrvVIYkwur2JMBZ6kINhCRFuaABOUEs64BRg40nOFblHTgr4:1OyRr9u1KJkZ6dIYBUeBRgOlWU
Malware Config
Extracted
asyncrat
Venom RAT 5.0.5
Venom Clients
resulttoday2.duckdns.org:6111
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Executes dropped EXE 2 IoCs
pid Process 1028 opetr.exe 1300 opetr.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2340 set thread context of 2544 2340 URFT06GSBAWRP_001_PDF.exe 36 PID 1028 set thread context of 808 1028 opetr.exe 45 -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URFT06GSBAWRP_001_PDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language opetr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language opetr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2684 schtasks.exe 284 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2544 vbc.exe Token: SeDebugPrivilege 808 vbc.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2064 2340 URFT06GSBAWRP_001_PDF.exe 31 PID 2340 wrote to memory of 2064 2340 URFT06GSBAWRP_001_PDF.exe 31 PID 2340 wrote to memory of 2064 2340 URFT06GSBAWRP_001_PDF.exe 31 PID 2340 wrote to memory of 2064 2340 URFT06GSBAWRP_001_PDF.exe 31 PID 2064 wrote to memory of 2684 2064 cmd.exe 33 PID 2064 wrote to memory of 2684 2064 cmd.exe 33 PID 2064 wrote to memory of 2684 2064 cmd.exe 33 PID 2064 wrote to memory of 2684 2064 cmd.exe 33 PID 2340 wrote to memory of 2764 2340 URFT06GSBAWRP_001_PDF.exe 34 PID 2340 wrote to memory of 2764 2340 URFT06GSBAWRP_001_PDF.exe 34 PID 2340 wrote to memory of 2764 2340 URFT06GSBAWRP_001_PDF.exe 34 PID 2340 wrote to memory of 2764 2340 URFT06GSBAWRP_001_PDF.exe 34 PID 2340 wrote to memory of 2544 2340 URFT06GSBAWRP_001_PDF.exe 36 PID 2340 wrote to memory of 2544 2340 URFT06GSBAWRP_001_PDF.exe 36 PID 2340 wrote to memory of 2544 2340 URFT06GSBAWRP_001_PDF.exe 36 PID 2340 wrote to memory of 2544 2340 URFT06GSBAWRP_001_PDF.exe 36 PID 2340 wrote to memory of 2544 2340 URFT06GSBAWRP_001_PDF.exe 36 PID 2340 wrote to memory of 2544 2340 URFT06GSBAWRP_001_PDF.exe 36 PID 2340 wrote to memory of 2544 2340 URFT06GSBAWRP_001_PDF.exe 36 PID 2340 wrote to memory of 2544 2340 URFT06GSBAWRP_001_PDF.exe 36 PID 2340 wrote to memory of 2544 2340 URFT06GSBAWRP_001_PDF.exe 36 PID 2300 wrote to memory of 1028 2300 taskeng.exe 38 PID 2300 wrote to memory of 1028 2300 taskeng.exe 38 PID 2300 wrote to memory of 1028 2300 taskeng.exe 38 PID 2300 wrote to memory of 1028 2300 taskeng.exe 38 PID 1028 wrote to memory of 2444 1028 opetr.exe 40 PID 1028 wrote to memory of 2444 1028 opetr.exe 40 PID 1028 wrote to memory of 2444 1028 opetr.exe 40 PID 1028 wrote to memory of 2444 1028 opetr.exe 40 PID 1028 wrote to memory of 864 1028 opetr.exe 42 PID 1028 wrote to memory of 864 1028 opetr.exe 42 PID 1028 wrote to memory of 864 1028 opetr.exe 42 PID 1028 wrote to memory of 864 1028 opetr.exe 42 PID 2444 wrote to memory of 284 2444 cmd.exe 43 PID 2444 wrote to memory of 284 2444 cmd.exe 43 PID 2444 wrote to memory of 284 2444 cmd.exe 43 PID 2444 wrote to memory of 284 2444 cmd.exe 43 PID 1028 wrote to memory of 808 1028 opetr.exe 45 PID 1028 wrote to memory of 808 1028 opetr.exe 45 PID 1028 wrote to memory of 808 1028 opetr.exe 45 PID 1028 wrote to memory of 808 1028 opetr.exe 45 PID 1028 wrote to memory of 808 1028 opetr.exe 45 PID 1028 wrote to memory of 808 1028 opetr.exe 45 PID 1028 wrote to memory of 808 1028 opetr.exe 45 PID 1028 wrote to memory of 808 1028 opetr.exe 45 PID 1028 wrote to memory of 808 1028 opetr.exe 45 PID 2300 wrote to memory of 1300 2300 taskeng.exe 46 PID 2300 wrote to memory of 1300 2300 taskeng.exe 46 PID 2300 wrote to memory of 1300 2300 taskeng.exe 46 PID 2300 wrote to memory of 1300 2300 taskeng.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF.exe"C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2684
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF.exe" "C:\Users\Admin\AppData\Roaming\opetr.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2764
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {B0C890F0-7E33-4C4C-AE1F-F01F1EBCC2E4} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Roaming\opetr.exeC:\Users\Admin\AppData\Roaming\opetr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\opetr.exe'" /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:284
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\opetr.exe" "C:\Users\Admin\AppData\Roaming\opetr.exe"3⤵
- System Location Discovery: System Language Discovery
PID:864
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
-
C:\Users\Admin\AppData\Roaming\opetr.exeC:\Users\Admin\AppData\Roaming\opetr.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1300
-