Analysis
-
max time kernel
39s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
28/01/2025, 15:17
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10ltsc2021-20250128-en
windows10-ltsc 2021-x64
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win11-20241007-en
windows11-21h2-x64
7 signatures
900 seconds
General
-
Target
Setup.exe
-
Size
63KB
-
MD5
b85c90b65f871ae5c9b27e79c95ec9b6
-
SHA1
bb8567553e3c8a86636396b90a8fa27a8379f390
-
SHA256
b6bd6b6f509dd5535166e6025f0b3ba75da5d761ec2f2b943e0d59a3c3decbd4
-
SHA512
ee055d86529a8a06874681fc848189aae76990916390384c986c4e67195560d66cfd0c4f97697cd94938995c9537dbf532c69cbc6a02d60ee91cda74d946a596
-
SSDEEP
1536:8hB5LrUwk4XO01VXFO0bxvweGbbxw1VvG6DpqKmY7:8hB5LrUwk4XVVXFO0dvfGbbxKzgz
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
5.0.5
Botnet
Venom Clients
C2
127.0.0.1:4449
Mutex
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4232 Setup.exe Token: SeDebugPrivilege 2144 taskmgr.exe Token: SeSystemProfilePrivilege 2144 taskmgr.exe Token: SeCreateGlobalPrivilege 2144 taskmgr.exe Token: 33 2144 taskmgr.exe Token: SeIncBasePriorityPrivilege 2144 taskmgr.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe -
Suspicious use of SendNotifyMessage 50 IoCs
pid Process 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe 2144 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2144