Analysis
-
max time kernel
147s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 02:29
Static task
static1
Behavioral task
behavioral1
Sample
BXA09QOPKJHVRFVU_001_PDF.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
BXA09QOPKJHVRFVU_001_PDF.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
RWVQ04HDJSNYKSDF03BD_002_PDF.vbs
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
RWVQ04HDJSNYKSDF03BD_002_PDF.vbs
Resource
win10v2004-20241007-en
General
-
Target
BXA09QOPKJHVRFVU_001_PDF.exe
-
Size
300.0MB
-
MD5
5b5b1099d3adbfba6ac4a0fe2c2a032e
-
SHA1
a0bfb095d19e54dd13f120b5b863c9ed9e02e7f7
-
SHA256
521c835ad73fb2d4e932e2cb36a5f95377f0314384339e5e18adc3e85238cd14
-
SHA512
c599cf5b2b04e871c45c884dc201f94f1038e96184610afa9a725349a590577fd823355b51fafb9a7f8aa8d8e78f724e936fac7e6e811dacc4060a25a41e8372
-
SSDEEP
3072:Z2eAJ+sffO8Q335Bdq5mV4LcPz3ipe+ZUjUcwtJFu4Ki:Z2Ssen35Bdq5mVUcr3ipJcUFuni
Malware Config
Extracted
asyncrat
Venom RAT 5.0.5
Venom Clients
gratedmonth.duckdns.org:8890
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Executes dropped EXE 2 IoCs
pid Process 2352 gherc.exe 1752 gherc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1884 set thread context of 2268 1884 BXA09QOPKJHVRFVU_001_PDF.exe 36 PID 2352 set thread context of 2700 2352 gherc.exe 45 PID 1752 set thread context of 1036 1752 gherc.exe 52 -
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gherc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gherc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BXA09QOPKJHVRFVU_001_PDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2932 schtasks.exe 956 schtasks.exe 2004 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2268 vbc.exe Token: SeDebugPrivilege 2700 vbc.exe Token: SeDebugPrivilege 1036 vbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2908 1884 BXA09QOPKJHVRFVU_001_PDF.exe 31 PID 1884 wrote to memory of 2908 1884 BXA09QOPKJHVRFVU_001_PDF.exe 31 PID 1884 wrote to memory of 2908 1884 BXA09QOPKJHVRFVU_001_PDF.exe 31 PID 1884 wrote to memory of 2908 1884 BXA09QOPKJHVRFVU_001_PDF.exe 31 PID 2908 wrote to memory of 2932 2908 cmd.exe 33 PID 2908 wrote to memory of 2932 2908 cmd.exe 33 PID 2908 wrote to memory of 2932 2908 cmd.exe 33 PID 2908 wrote to memory of 2932 2908 cmd.exe 33 PID 1884 wrote to memory of 2896 1884 BXA09QOPKJHVRFVU_001_PDF.exe 34 PID 1884 wrote to memory of 2896 1884 BXA09QOPKJHVRFVU_001_PDF.exe 34 PID 1884 wrote to memory of 2896 1884 BXA09QOPKJHVRFVU_001_PDF.exe 34 PID 1884 wrote to memory of 2896 1884 BXA09QOPKJHVRFVU_001_PDF.exe 34 PID 1884 wrote to memory of 2268 1884 BXA09QOPKJHVRFVU_001_PDF.exe 36 PID 1884 wrote to memory of 2268 1884 BXA09QOPKJHVRFVU_001_PDF.exe 36 PID 1884 wrote to memory of 2268 1884 BXA09QOPKJHVRFVU_001_PDF.exe 36 PID 1884 wrote to memory of 2268 1884 BXA09QOPKJHVRFVU_001_PDF.exe 36 PID 1884 wrote to memory of 2268 1884 BXA09QOPKJHVRFVU_001_PDF.exe 36 PID 1884 wrote to memory of 2268 1884 BXA09QOPKJHVRFVU_001_PDF.exe 36 PID 1884 wrote to memory of 2268 1884 BXA09QOPKJHVRFVU_001_PDF.exe 36 PID 1884 wrote to memory of 2268 1884 BXA09QOPKJHVRFVU_001_PDF.exe 36 PID 1884 wrote to memory of 2268 1884 BXA09QOPKJHVRFVU_001_PDF.exe 36 PID 2664 wrote to memory of 2352 2664 taskeng.exe 39 PID 2664 wrote to memory of 2352 2664 taskeng.exe 39 PID 2664 wrote to memory of 2352 2664 taskeng.exe 39 PID 2664 wrote to memory of 2352 2664 taskeng.exe 39 PID 2352 wrote to memory of 2840 2352 gherc.exe 40 PID 2352 wrote to memory of 2840 2352 gherc.exe 40 PID 2352 wrote to memory of 2840 2352 gherc.exe 40 PID 2352 wrote to memory of 2840 2352 gherc.exe 40 PID 2352 wrote to memory of 1532 2352 gherc.exe 42 PID 2352 wrote to memory of 1532 2352 gherc.exe 42 PID 2352 wrote to memory of 1532 2352 gherc.exe 42 PID 2352 wrote to memory of 1532 2352 gherc.exe 42 PID 2840 wrote to memory of 956 2840 cmd.exe 43 PID 2840 wrote to memory of 956 2840 cmd.exe 43 PID 2840 wrote to memory of 956 2840 cmd.exe 43 PID 2840 wrote to memory of 956 2840 cmd.exe 43 PID 2352 wrote to memory of 2700 2352 gherc.exe 45 PID 2352 wrote to memory of 2700 2352 gherc.exe 45 PID 2352 wrote to memory of 2700 2352 gherc.exe 45 PID 2352 wrote to memory of 2700 2352 gherc.exe 45 PID 2352 wrote to memory of 2700 2352 gherc.exe 45 PID 2352 wrote to memory of 2700 2352 gherc.exe 45 PID 2352 wrote to memory of 2700 2352 gherc.exe 45 PID 2352 wrote to memory of 2700 2352 gherc.exe 45 PID 2352 wrote to memory of 2700 2352 gherc.exe 45 PID 2664 wrote to memory of 1752 2664 taskeng.exe 46 PID 2664 wrote to memory of 1752 2664 taskeng.exe 46 PID 2664 wrote to memory of 1752 2664 taskeng.exe 46 PID 2664 wrote to memory of 1752 2664 taskeng.exe 46 PID 1752 wrote to memory of 1032 1752 gherc.exe 47 PID 1752 wrote to memory of 1032 1752 gherc.exe 47 PID 1752 wrote to memory of 1032 1752 gherc.exe 47 PID 1752 wrote to memory of 1032 1752 gherc.exe 47 PID 1032 wrote to memory of 2004 1032 cmd.exe 50 PID 1032 wrote to memory of 2004 1032 cmd.exe 50 PID 1032 wrote to memory of 2004 1032 cmd.exe 50 PID 1032 wrote to memory of 2004 1032 cmd.exe 50 PID 1752 wrote to memory of 1416 1752 gherc.exe 49 PID 1752 wrote to memory of 1416 1752 gherc.exe 49 PID 1752 wrote to memory of 1416 1752 gherc.exe 49 PID 1752 wrote to memory of 1416 1752 gherc.exe 49 PID 1752 wrote to memory of 1036 1752 gherc.exe 52 PID 1752 wrote to memory of 1036 1752 gherc.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\BXA09QOPKJHVRFVU_001_PDF.exe"C:\Users\Admin\AppData\Local\Temp\BXA09QOPKJHVRFVU_001_PDF.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\gherc.exe'" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\gherc.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2932
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\BXA09QOPKJHVRFVU_001_PDF.exe" "C:\Users\Admin\AppData\Roaming\gherc.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2896
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {CEDEA3FB-239F-448A-9C6F-17885717B260} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Roaming\gherc.exeC:\Users\Admin\AppData\Roaming\gherc.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\gherc.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\gherc.exe'" /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:956
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\gherc.exe" "C:\Users\Admin\AppData\Roaming\gherc.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1532
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
-
C:\Users\Admin\AppData\Roaming\gherc.exeC:\Users\Admin\AppData\Roaming\gherc.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\gherc.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\gherc.exe'" /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2004
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\gherc.exe" "C:\Users\Admin\AppData\Roaming\gherc.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1416
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
-