Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 15:19
Behavioral task
behavioral1
Sample
IYBF9_Client.exe
Resource
win7-20241023-en
General
-
Target
IYBF9_Client.exe
-
Size
74KB
-
MD5
4e621ed074da8d121a8f419c00cb4c3a
-
SHA1
723df7256adbaddecf269abfd255d28b5b860f1e
-
SHA256
dca4f9884f0b0f5a1c534b3b2d867714b6ea7eac807bacf9e487e9a8d7e34355
-
SHA512
77ebc87c1582d1f83195d2dd0f76432f895acac7b07cb1bca6599d7c42d83a544abcf719d9d80fc6e51cda05c6d9e3af06daed17a8fe970425030ab5fd0aaa1f
-
SSDEEP
1536:SUaAcx2l/Cx2PMVie9VdQuDI6H1bf/k0WQzcuLVclN:SUDcx2Bq2PMVie9VdQsH1bfcjQnBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
127.0.0.1:4449
5.20.104.111:4449
kekagthwfcue
-
delay
1
-
install
true
-
install_file
defender.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
resource yara_rule behavioral2/memory/920-1-0x00000000000A0000-0x00000000000B8000-memory.dmp VenomRAT behavioral2/files/0x0032000000023b75-12.dat VenomRAT -
Venomrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0032000000023b75-12.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation IYBF9_Client.exe -
Executes dropped EXE 1 IoCs
pid Process 4260 defender.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 1036 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1584 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 920 IYBF9_Client.exe 4260 defender.exe 4260 defender.exe 4260 defender.exe 4260 defender.exe 4260 defender.exe 4260 defender.exe 4260 defender.exe 4260 defender.exe 4260 defender.exe 4260 defender.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 920 IYBF9_Client.exe Token: SeDebugPrivilege 4260 defender.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4260 defender.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 920 wrote to memory of 2680 920 IYBF9_Client.exe 82 PID 920 wrote to memory of 2680 920 IYBF9_Client.exe 82 PID 920 wrote to memory of 1092 920 IYBF9_Client.exe 84 PID 920 wrote to memory of 1092 920 IYBF9_Client.exe 84 PID 1092 wrote to memory of 1036 1092 cmd.exe 87 PID 1092 wrote to memory of 1036 1092 cmd.exe 87 PID 2680 wrote to memory of 1584 2680 cmd.exe 86 PID 2680 wrote to memory of 1584 2680 cmd.exe 86 PID 1092 wrote to memory of 4260 1092 cmd.exe 90 PID 1092 wrote to memory of 4260 1092 cmd.exe 90 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\IYBF9_Client.exe"C:\Users\Admin\AppData\Local\Temp\IYBF9_Client.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "defender" /tr '"C:\Users\Admin\AppData\Roaming\defender.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "defender" /tr '"C:\Users\Admin\AppData\Roaming\defender.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:1584
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp82D5.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1036
-
-
C:\Users\Admin\AppData\Roaming\defender.exe"C:\Users\Admin\AppData\Roaming\defender.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4260
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54a3b45f4274654dc8a5167d6f4bd5642
SHA13c67d7de0c2ae245bd1da93d6aeca584d8729300
SHA25604b068d1abce5f5db23cd945bcda996a211ea3073a0cd099e3eb7239f5ad17a7
SHA512f5449d6b8ce3c56d38b3923d4509ef003557177518b73600612bc0129ad0fdfd187649f80cae2b48b4bd9b326088ec3f838e8a17bf6c20b8febf1a1ef8a424a9
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
74KB
MD54e621ed074da8d121a8f419c00cb4c3a
SHA1723df7256adbaddecf269abfd255d28b5b860f1e
SHA256dca4f9884f0b0f5a1c534b3b2d867714b6ea7eac807bacf9e487e9a8d7e34355
SHA51277ebc87c1582d1f83195d2dd0f76432f895acac7b07cb1bca6599d7c42d83a544abcf719d9d80fc6e51cda05c6d9e3af06daed17a8fe970425030ab5fd0aaa1f