Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/01/2025, 15:44
Behavioral task
behavioral1
Sample
8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe
Resource
win7-20240903-en
General
-
Target
8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe
-
Size
74KB
-
MD5
691bc0e47a381c96ffcc10e0ce7afd10
-
SHA1
eecb7fb5afd34a029bdaefcb4a9119f4f185533f
-
SHA256
8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411
-
SHA512
9a6106a7609e9f71d7af57d14f07d3166ef70aca30334143a114108076823e67b569eda94d9655d19e610349832c1a8c9802ceb9b10c820f2bb622b7622e6098
-
SSDEEP
1536:EUckcx4VHsC0SPMV7e9VdQuDI6H1bf/ce2+Qzc2LVclN:EUpcx4GfSPMV7e9VdQsH1bf0e2+QPBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
Rmc
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/iRj0W279
Signatures
-
Asyncrat family
-
resource yara_rule behavioral2/memory/5068-1-0x0000000000700000-0x0000000000718000-memory.dmp VenomRAT -
Venomrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 39 IoCs
flow ioc 20 pastebin.com 29 pastebin.com 72 pastebin.com 75 pastebin.com 31 pastebin.com 59 pastebin.com 60 pastebin.com 61 pastebin.com 65 pastebin.com 30 pastebin.com 45 pastebin.com 52 pastebin.com 62 pastebin.com 74 pastebin.com 51 pastebin.com 53 pastebin.com 63 pastebin.com 56 pastebin.com 73 pastebin.com 79 pastebin.com 17 pastebin.com 46 pastebin.com 48 pastebin.com 49 pastebin.com 50 pastebin.com 13 pastebin.com 14 pastebin.com 19 pastebin.com 57 pastebin.com 64 pastebin.com 27 pastebin.com 58 pastebin.com 68 pastebin.com 77 pastebin.com 78 pastebin.com 23 pastebin.com 28 pastebin.com 47 pastebin.com 76 pastebin.com -
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5068 8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe"C:\Users\Admin\AppData\Local\Temp\8d4c69f370e3a1e608f0c0deeca8b1ab1be76393c4c02cd6140d73c11dd4d411N.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5068