Malware Analysis Report

2024-12-08 02:24

Sample ID 241118-vw8eessakk
Target setup.exe
SHA256 d87bc6b532f94b6023c55bb38f96f0472857bb7742db4199704386bf8f533fb9
Tags
venomrat evasion rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d87bc6b532f94b6023c55bb38f96f0472857bb7742db4199704386bf8f533fb9

Threat Level: Known bad

The file setup.exe was found to be: Known bad.

Malicious Activity Summary

venomrat evasion rat

Venomrat family

VenomRAT

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Checks BIOS information in registry

Executes dropped EXE

Maps connected drives based on registry

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-18 17:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-18 17:21

Reported

2024-11-18 17:24

Platform

win7-20240903-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

Signatures

VenomRAT

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Venomrat family

venomrat

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\setup.bat" "

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

Network

N/A

Files

memory/2096-0-0x000007FEF5FD3000-0x000007FEF5FD4000-memory.dmp

memory/2096-1-0x0000000001300000-0x000000000132A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\setup.bat

MD5 bac1df08b5a2b813d82ace3a51adc67f
SHA1 bd1279e6379de4ea6ac108718010235f3b342405
SHA256 59f5244b33fe77d4dfe76e5159d44a07e037040f8790276ec84139ed3128a21b
SHA512 175b17c6e7d91aea20e6d8d3b63abfd467c0cf7fc6b8c574e39dbffeb52db8c40020816291f7a83e0411a165d0535c033ff1df299dd2c2a7e48ba8b34dcd4afa

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 f16db0ec9722cf4e3d7761a317097568
SHA1 0f1f15468a7db5a662909f3a1a7e03e05a6a0533
SHA256 aaf473cb17bcf36a00222fd8ca4493a4a4b0f9fda3678a1a56d2be1a52cbf5f4
SHA512 f8ed6b01473cbd9b455d88b30afe3490ebc5881b5607871e693cbdfb401460ebc6b3cff1cbf1cb554a8da26f0ec55d76f3a3778d35db55f28ca3c668da1c30c8

memory/996-15-0x0000000000B60000-0x0000000000BA0000-memory.dmp

memory/996-17-0x0000000000360000-0x0000000000366000-memory.dmp

memory/2096-18-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

memory/996-19-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

memory/996-20-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

memory/996-21-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-18 17:21

Reported

2024-11-18 17:24

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

Signatures

VenomRAT

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Venomrat family

venomrat

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\setup.bat" "

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/1952-0-0x00007FF97C103000-0x00007FF97C105000-memory.dmp

memory/1952-1-0x0000000000F80000-0x0000000000FAA000-memory.dmp

memory/1952-6-0x00007FF97C100000-0x00007FF97CBC1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 f16db0ec9722cf4e3d7761a317097568
SHA1 0f1f15468a7db5a662909f3a1a7e03e05a6a0533
SHA256 aaf473cb17bcf36a00222fd8ca4493a4a4b0f9fda3678a1a56d2be1a52cbf5f4
SHA512 f8ed6b01473cbd9b455d88b30afe3490ebc5881b5607871e693cbdfb401460ebc6b3cff1cbf1cb554a8da26f0ec55d76f3a3778d35db55f28ca3c668da1c30c8

memory/1412-20-0x00007FF97C100000-0x00007FF97CBC1000-memory.dmp

memory/1412-19-0x000000001BC40000-0x000000001BC46000-memory.dmp

memory/1412-18-0x0000000000DE0000-0x0000000000E20000-memory.dmp

memory/1952-21-0x00007FF97C100000-0x00007FF97CBC1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\setup.bat

MD5 bac1df08b5a2b813d82ace3a51adc67f
SHA1 bd1279e6379de4ea6ac108718010235f3b342405
SHA256 59f5244b33fe77d4dfe76e5159d44a07e037040f8790276ec84139ed3128a21b
SHA512 175b17c6e7d91aea20e6d8d3b63abfd467c0cf7fc6b8c574e39dbffeb52db8c40020816291f7a83e0411a165d0535c033ff1df299dd2c2a7e48ba8b34dcd4afa

memory/1412-24-0x00007FF97C100000-0x00007FF97CBC1000-memory.dmp