Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 02:29
Static task
static1
Behavioral task
behavioral1
Sample
BXA09QOPKJHVRFVU_001_PDF.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
BXA09QOPKJHVRFVU_001_PDF.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
RWVQ04HDJSNYKSDF03BD_002_PDF.vbs
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
RWVQ04HDJSNYKSDF03BD_002_PDF.vbs
Resource
win10v2004-20241007-en
General
-
Target
BXA09QOPKJHVRFVU_001_PDF.exe
-
Size
300.0MB
-
MD5
5b5b1099d3adbfba6ac4a0fe2c2a032e
-
SHA1
a0bfb095d19e54dd13f120b5b863c9ed9e02e7f7
-
SHA256
521c835ad73fb2d4e932e2cb36a5f95377f0314384339e5e18adc3e85238cd14
-
SHA512
c599cf5b2b04e871c45c884dc201f94f1038e96184610afa9a725349a590577fd823355b51fafb9a7f8aa8d8e78f724e936fac7e6e811dacc4060a25a41e8372
-
SSDEEP
3072:Z2eAJ+sffO8Q335Bdq5mV4LcPz3ipe+ZUjUcwtJFu4Ki:Z2Ssen35Bdq5mVUcr3ipJcUFuni
Malware Config
Extracted
asyncrat
Venom RAT 5.0.5
Venom Clients
gratedmonth.duckdns.org:8890
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Executes dropped EXE 2 IoCs
pid Process 2920 gherc.exe 2340 gherc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 636 set thread context of 3404 636 BXA09QOPKJHVRFVU_001_PDF.exe 104 PID 2920 set thread context of 3224 2920 gherc.exe 114 -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gherc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gherc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BXA09QOPKJHVRFVU_001_PDF.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 516 schtasks.exe 1456 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3404 vbc.exe Token: SeDebugPrivilege 3224 vbc.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 636 wrote to memory of 400 636 BXA09QOPKJHVRFVU_001_PDF.exe 99 PID 636 wrote to memory of 400 636 BXA09QOPKJHVRFVU_001_PDF.exe 99 PID 636 wrote to memory of 400 636 BXA09QOPKJHVRFVU_001_PDF.exe 99 PID 400 wrote to memory of 516 400 cmd.exe 101 PID 400 wrote to memory of 516 400 cmd.exe 101 PID 400 wrote to memory of 516 400 cmd.exe 101 PID 636 wrote to memory of 3932 636 BXA09QOPKJHVRFVU_001_PDF.exe 102 PID 636 wrote to memory of 3932 636 BXA09QOPKJHVRFVU_001_PDF.exe 102 PID 636 wrote to memory of 3932 636 BXA09QOPKJHVRFVU_001_PDF.exe 102 PID 636 wrote to memory of 3404 636 BXA09QOPKJHVRFVU_001_PDF.exe 104 PID 636 wrote to memory of 3404 636 BXA09QOPKJHVRFVU_001_PDF.exe 104 PID 636 wrote to memory of 3404 636 BXA09QOPKJHVRFVU_001_PDF.exe 104 PID 636 wrote to memory of 3404 636 BXA09QOPKJHVRFVU_001_PDF.exe 104 PID 636 wrote to memory of 3404 636 BXA09QOPKJHVRFVU_001_PDF.exe 104 PID 636 wrote to memory of 3404 636 BXA09QOPKJHVRFVU_001_PDF.exe 104 PID 636 wrote to memory of 3404 636 BXA09QOPKJHVRFVU_001_PDF.exe 104 PID 636 wrote to memory of 3404 636 BXA09QOPKJHVRFVU_001_PDF.exe 104 PID 2920 wrote to memory of 2584 2920 gherc.exe 109 PID 2920 wrote to memory of 2584 2920 gherc.exe 109 PID 2920 wrote to memory of 2584 2920 gherc.exe 109 PID 2920 wrote to memory of 2036 2920 gherc.exe 111 PID 2920 wrote to memory of 2036 2920 gherc.exe 111 PID 2920 wrote to memory of 2036 2920 gherc.exe 111 PID 2584 wrote to memory of 1456 2584 cmd.exe 113 PID 2584 wrote to memory of 1456 2584 cmd.exe 113 PID 2584 wrote to memory of 1456 2584 cmd.exe 113 PID 2920 wrote to memory of 3224 2920 gherc.exe 114 PID 2920 wrote to memory of 3224 2920 gherc.exe 114 PID 2920 wrote to memory of 3224 2920 gherc.exe 114 PID 2920 wrote to memory of 3224 2920 gherc.exe 114 PID 2920 wrote to memory of 3224 2920 gherc.exe 114 PID 2920 wrote to memory of 3224 2920 gherc.exe 114 PID 2920 wrote to memory of 3224 2920 gherc.exe 114 PID 2920 wrote to memory of 3224 2920 gherc.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\BXA09QOPKJHVRFVU_001_PDF.exe"C:\Users\Admin\AppData\Local\Temp\BXA09QOPKJHVRFVU_001_PDF.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\gherc.exe'" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\gherc.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:516
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\BXA09QOPKJHVRFVU_001_PDF.exe" "C:\Users\Admin\AppData\Roaming\gherc.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3932
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3404
-
-
C:\Users\Admin\AppData\Roaming\gherc.exeC:\Users\Admin\AppData\Roaming\gherc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\gherc.exe'" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\gherc.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1456
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\gherc.exe" "C:\Users\Admin\AppData\Roaming\gherc.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2036
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3224
-
-
C:\Users\Admin\AppData\Roaming\gherc.exeC:\Users\Admin\AppData\Roaming\gherc.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
612B
MD5ca95b0db0b212857216268544c58e741
SHA15c2fd4ee1dc02d9412a19454562129f97bf930b5
SHA256bdcf4429adc6ee689394b8ea1628e98bac4d0b7f8d735e5bf9e96218a41cd6f0
SHA512c3d83412ec5c6dd7398c7ec0ae73838eed3f9e6e539771066378d74479092bc18f73deac581c3e5f053487eef1ae432a565eec2aa706c7ddf16d5855cb0e70bb