46c17ffefbfcaa044cbbcbb33d6219da84538c22a51e53bff647c87da33a0bd9

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 16:14

Target

VenomRAT v6.0.3 (+SOURCE)/VenomRAT v6.0.3 (SOURCE)/Plugins/Keylogger.exe
Size

13KB
MD5

b891f6eac297cc501c01687a041e2ca5
SHA1

2dd0748b0952dc7d73943f0b24f5036a2773bf24
SHA256

b0df63466dd20c4f860263eafba2feb255bf31ea43264a142f8e9010b27d016c
SHA512

d525c84a2ab967d65c5538aa46c0a126221582c820bde9c101105f27ea8d0c819161a1764872bb6e469c07bc2f53003e7a453e518ffa59aaa919370687bd90a6
SSDEEP

384:A4MtOoYttncuYsLhH3dF5L18GEP8Tx/NoE:qEbtQO5LS/P8Tx/n

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2172	Keylogger.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2172	Keylogger.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2172	Keylogger.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2100	2172	Keylogger.exe	30
PID 2172 wrote to memory of 2100	2172	Keylogger.exe	30
PID 2172 wrote to memory of 2100	2172	Keylogger.exe	30

C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3 (+SOURCE)\VenomRAT v6.0.3 (SOURCE)\Plugins\Keylogger.exe
"C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3 (+SOURCE)\VenomRAT v6.0.3 (SOURCE)\Plugins\Keylogger.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2172 -s 632
  2⤵
  PID:2100

memory/2172-0-0x000007FEF5AA3000-0x000007FEF5AA4000-memory.dmp

Filesize
4KB

Download
memory/2172-1-0x0000000001000000-0x000000000100A000-memory.dmp

Filesize
40KB

Download
memory/2172-2-0x000007FEF5AA0000-0x000007FEF648C000-memory.dmp

Filesize
9.9MB

Download
memory/2172-3-0x000007FEF5AA0000-0x000007FEF648C000-memory.dmp

Filesize
9.9MB

Download