Resubmissions
31-12-2024 16:38
241231-t5hppa1qbp 10Analysis
-
max time kernel
71s -
max time network
80s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 16:38
General
-
Target
VENOMRAT_6_0_3_CRACKED_+_HVNC_+_STEALER_&_GRABBER_+_SOURCE_CODE.zip
-
Size
111.8MB
-
MD5
d009fe1b7cf7c53f446ce3fe5554faeb
-
SHA1
4ede2314647b51fd7829bf790d871c861a79c513
-
SHA256
060aa6148d50017930bb2117e5c5c8c56f42f243c892ff59dc509d4c65f16700
-
SHA512
1975797a4240ebb64921ace78c183c22ffedf7c27da2193fb292f3420af84e333a2173ef95982a309954daa0121140cc3a0742837f4af9f2bf7898ff769482d3
-
SSDEEP
3145728:+rYqkVVhVAa7IguLB7BnlrOVi3y0Ai7X2Uj/HSZDNzLK5:wYqk9ElFZP7XMpL0
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\VENOMRAT_6_0_3_CRACKED_+_HVNC_+_STEALER_&_GRABBER_+_SOURCE_CODE.zip"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\VENOMRAT 6.0.3 CRACKED + HVNC + STEALER & GRABBER + SOURCE CODE\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\Desktop\VENOMRAT 6.0.3 CRACKED + HVNC + STEALER & GRABBER + SOURCE CODE\Venom RAT + HVNC + Stealer + Grabber.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Venom RAT + HVNC + Stealer + Grabber.exe"C:\Users\Admin\AppData\Local\Temp\Venom RAT + HVNC + Stealer + Grabber.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.2MB
MD53b3a304c6fc7a3a1d9390d7cbff56634
SHA1e8bd5244e6362968f5017680da33f1e90ae63dd7
SHA2567331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58
SHA5127f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5
-
Filesize
506KB
MD5e5fb57e8214483fd395bd431cb3d1c4b
SHA160e22fc9e0068c8156462f003760efdcac82766b
SHA256e389fc5782f754918a10b020adcd8faa11c25658b8d6f8cbc49f9ac3a7637684
SHA512dc2ed0421db7dd5a3afeacb6a9f5017c97fc07d0b2d1745b50ede50087a58245d31d6669077a672b32541dbfa233ef87260a37be48de3bd407d8c587fc903d89
-
Filesize
14.7MB
MD5739d54d33fadefd5dbf6905b2368a099
SHA1cbed6d9aa5522a1a6ec49306ab2810246478b87a
SHA25628622cf37668d11ee26d856e9d0bea668e00f8ab41117c8c22405aa29df8c95d
SHA5124e6bb12b28d4eee1ccb05acc6cc89bed8156424132a08c28904b74c89f895fd179f060d0916ecd65666942d14d1692e32a8512cae9f1ce1cd503683f8fffdc50
-
Filesize
14.2MB
-
Filesize
344KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
14.7MB