Analysis
-
max time kernel
15s -
max time network
4s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2025, 17:32
Behavioral task
behavioral1
Sample
Stafbesting Ultimate/MessagePackLib.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
Stafbesting Ultimate/Microsoft.Win32.Primitives.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
Stafbesting Ultimate/Newtonsoft.Json.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
Stafbesting Ultimate/STAFFBESTING ULTIMATE.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
7 signatures
900 seconds
Behavioral task
behavioral5
Sample
Stafbesting Ultimate/netstandard.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
900 seconds
General
-
Target
Stafbesting Ultimate/STAFFBESTING ULTIMATE.exe
-
Size
236KB
-
MD5
f199439ba1c1e5b9ac2d9f55210cbd4a
-
SHA1
9ce26a30466e732d16d840842fae2d6f1adae673
-
SHA256
792a486598d655e04f11104c4262a6c0db8f28538799acccc7b3a169b6e533dc
-
SHA512
96d662eec309cfec6e317007945378be5d56490d34efa0b5e44a3691d1759ebea39aad277ee6e34b52c80d8bb600f88c12ef8002a80bf4ed316909659b15d7eb
-
SSDEEP
3072:vU7cxoyXkiPMVz6Xc1b5KcJlqQ6IC7D4NxUe+Cyy5GJA7lbYW46V0mHI5EZBY:vbkiPMVz0abTcbIC7UNvD15xaAo5En
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
Mutex
zzzxbdsybzu
Attributes
-
c2_url_file
https://paste.ee/r/COm4hFYr/0
-
delay
1
-
install
true
-
install_file
Systeam.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeIncreaseQuotaPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeSecurityPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeTakeOwnershipPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeLoadDriverPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeSystemProfilePrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeSystemtimePrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeProfSingleProcessPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeIncBasePriorityPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeCreatePagefilePrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeBackupPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeRestorePrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeShutdownPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeDebugPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeSystemEnvironmentPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeRemoteShutdownPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeUndockPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeManageVolumePrivilege 3728 STAFFBESTING ULTIMATE.exe Token: 33 3728 STAFFBESTING ULTIMATE.exe Token: 34 3728 STAFFBESTING ULTIMATE.exe Token: 35 3728 STAFFBESTING ULTIMATE.exe Token: 36 3728 STAFFBESTING ULTIMATE.exe Token: SeIncreaseQuotaPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeSecurityPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeTakeOwnershipPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeLoadDriverPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeSystemProfilePrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeSystemtimePrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeProfSingleProcessPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeIncBasePriorityPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeCreatePagefilePrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeBackupPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeRestorePrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeShutdownPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeDebugPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeSystemEnvironmentPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeRemoteShutdownPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeUndockPrivilege 3728 STAFFBESTING ULTIMATE.exe Token: SeManageVolumePrivilege 3728 STAFFBESTING ULTIMATE.exe Token: 33 3728 STAFFBESTING ULTIMATE.exe Token: 34 3728 STAFFBESTING ULTIMATE.exe Token: 35 3728 STAFFBESTING ULTIMATE.exe Token: 36 3728 STAFFBESTING ULTIMATE.exe Token: SeDebugPrivilege 3156 taskmgr.exe Token: SeSystemProfilePrivilege 3156 taskmgr.exe Token: SeCreateGlobalPrivilege 3156 taskmgr.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe -
Suspicious use of SendNotifyMessage 25 IoCs
pid Process 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stafbesting Ultimate\STAFFBESTING ULTIMATE.exe"C:\Users\Admin\AppData\Local\Temp\Stafbesting Ultimate\STAFFBESTING ULTIMATE.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3728
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3156