Analysis
-
max time kernel
438s -
max time network
551s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
10-12-2024 22:19
General
-
Target
VenomRAT_v6.0.3.rar
-
Size
92.3MB
-
MD5
7cbabf71dd915f44b67f1765e805e5ab
-
SHA1
bc44d2fd089fc818824a5eb8f3c4310636dc2b81
-
SHA256
668bf9ed54120899b86b21a8aa1df1075937b8c05cfca52817746b6e418e2006
-
SHA512
9a3171a9c0f813b2c228348d2d4a3b94457578a6d1d5f80d7780fffcc3d67731b49b2cfe38f6ba4498203f1551e7c1cbc7b60d2ccc4dd8412943bc634a870509
-
SSDEEP
1572864:Ox40amHGeCj7VmyotHgaspW71f6xJgOBWWqwGaoAaCAOEFHiWlMvbRje/L20J1XP:raCj7VJoBgaMW75KC1Wq0TUORWudA203
Malware Config
Signatures
-
.NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Executes dropped EXE 7 IoCs
-
Modifies registry class 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3.rar"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zO8D517528\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\AppData\Local\Temp\7zO8D517528\Venom RAT + HVNC + Stealer + Grabber.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Desktop\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\Desktop\Venom RAT + HVNC + Stealer + Grabber.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\Desktop\Venom RAT + HVNC + Stealer + Grabber.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\Desktop\Venom RAT + HVNC + Stealer + Grabber.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
-
C:\Users\Admin\Desktop\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\Desktop\Venom RAT + HVNC + Stealer + Grabber.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\Desktop\Venom RAT + HVNC + Stealer + Grabber.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\Desktop\Venom RAT + HVNC + Stealer + Grabber.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
Filesize
8.3MB
MD5d3731f0b18e95da5c477cce1c13913ca
SHA110870da4f1880f7b48ce2530c929f4d5c8760cc1
SHA256a0df1f45f393c5b249f77f57c2647fd80631de1aaa77dbc318ddd853abbdffe5
SHA5123d273cd7bc73fa03d8c498c1ac3d423cac7e23fe266e3a1b32f93ab1e9c29c341e1ae8e1305d310486762998bca2ec8d711698a73428d2180f683ecbd2364865
-
Filesize
8KB
-
Filesize
8.3MB
-
Filesize
10.8MB
-
Filesize
10.8MB