Analysis
-
max time kernel
145s -
max time network
95s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250128-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
29/01/2025, 17:39
General
-
Target
staffbesting.rar
-
Size
358KB
-
MD5
961e2434f73d1ea24c9e390f839a2bf7
-
SHA1
5e5127fc1fb752d41b5e4feffa720272c884ae37
-
SHA256
644bf15ecd1fe95c3c559e130a2423618235661befac49ec017197936bf5efda
-
SHA512
07d7d71d3e7ec6c94cc4733112a65f0b5c0eb112092de8ea70e5f54b2c5c2cd7002323f9bcd8f2de781114be4d70ba5b8c16fabea9d8defa939ee1d5c629f586
-
SSDEEP
6144:50+LWIOQmUayBeHhBSN44WSuyltW5T0LGycZegsXz8HAVJbXHGSB2:50+L9OQtFNmriW5ILGbZQD8HAfme2
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
Mutex
zzzxbdsybzu
Attributes
-
c2_url_file
https://paste.ee/r/COm4hFYr/0
-
delay
1
-
install
true
-
install_file
Systeam.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000b000000027ccb-4.dat family_asyncrat -
Executes dropped EXE 5 IoCs
pid Process 5016 STAFFBESTING ULTIMATE.exe 1120 STAFFBESTING ULTIMATE.exe 4788 STAFFBESTING ULTIMATE.exe 436 STAFFBESTING ULTIMATE.exe 1472 STAFFBESTING ULTIMATE.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 3776 7zFM.exe 3776 7zFM.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3776 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 3776 7zFM.exe Token: 35 3776 7zFM.exe Token: SeSecurityPrivilege 3776 7zFM.exe Token: SeDebugPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeIncreaseQuotaPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeSecurityPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeTakeOwnershipPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeLoadDriverPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeSystemProfilePrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeSystemtimePrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeProfSingleProcessPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeIncBasePriorityPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeCreatePagefilePrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeBackupPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeRestorePrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeShutdownPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeDebugPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeSystemEnvironmentPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeRemoteShutdownPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeUndockPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeManageVolumePrivilege 5016 STAFFBESTING ULTIMATE.exe Token: 33 5016 STAFFBESTING ULTIMATE.exe Token: 34 5016 STAFFBESTING ULTIMATE.exe Token: 35 5016 STAFFBESTING ULTIMATE.exe Token: 36 5016 STAFFBESTING ULTIMATE.exe Token: SeIncreaseQuotaPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeSecurityPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeTakeOwnershipPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeLoadDriverPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeSystemProfilePrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeSystemtimePrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeProfSingleProcessPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeIncBasePriorityPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeCreatePagefilePrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeBackupPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeRestorePrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeShutdownPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeDebugPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeSystemEnvironmentPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeRemoteShutdownPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeUndockPrivilege 5016 STAFFBESTING ULTIMATE.exe Token: SeManageVolumePrivilege 5016 STAFFBESTING ULTIMATE.exe Token: 33 5016 STAFFBESTING ULTIMATE.exe Token: 34 5016 STAFFBESTING ULTIMATE.exe Token: 35 5016 STAFFBESTING ULTIMATE.exe Token: 36 5016 STAFFBESTING ULTIMATE.exe Token: SeSecurityPrivilege 3776 7zFM.exe Token: SeDebugPrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeIncreaseQuotaPrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeSecurityPrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeTakeOwnershipPrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeLoadDriverPrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeSystemProfilePrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeSystemtimePrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeProfSingleProcessPrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeIncBasePriorityPrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeCreatePagefilePrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeBackupPrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeRestorePrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeShutdownPrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeDebugPrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeSystemEnvironmentPrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeRemoteShutdownPrivilege 1120 STAFFBESTING ULTIMATE.exe Token: SeUndockPrivilege 1120 STAFFBESTING ULTIMATE.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3776 7zFM.exe 3776 7zFM.exe 3776 7zFM.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe -
Suspicious use of SendNotifyMessage 61 IoCs
pid Process 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe 5076 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3776 wrote to memory of 5016 3776 7zFM.exe 83 PID 3776 wrote to memory of 5016 3776 7zFM.exe 83
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\staffbesting.rar"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\7zO0CE5F5A7\STAFFBESTING ULTIMATE.exe"C:\Users\Admin\AppData\Local\Temp\7zO0CE5F5A7\STAFFBESTING ULTIMATE.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
-
C:\Users\Admin\Desktop\STAFFBESTING ULTIMATE.exe"C:\Users\Admin\Desktop\STAFFBESTING ULTIMATE.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1120
-
C:\Users\Admin\Desktop\STAFFBESTING ULTIMATE.exe"C:\Users\Admin\Desktop\STAFFBESTING ULTIMATE.exe"1⤵
- Executes dropped EXE
PID:4788
-
C:\Users\Admin\Desktop\STAFFBESTING ULTIMATE.exe"C:\Users\Admin\Desktop\STAFFBESTING ULTIMATE.exe"1⤵
- Executes dropped EXE
PID:436
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5076
-
C:\Users\Admin\Desktop\STAFFBESTING ULTIMATE.exe"C:\Users\Admin\Desktop\STAFFBESTING ULTIMATE.exe"1⤵
- Executes dropped EXE
PID:1472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD5f199439ba1c1e5b9ac2d9f55210cbd4a
SHA19ce26a30466e732d16d840842fae2d6f1adae673
SHA256792a486598d655e04f11104c4262a6c0db8f28538799acccc7b3a169b6e533dc
SHA51296d662eec309cfec6e317007945378be5d56490d34efa0b5e44a3691d1759ebea39aad277ee6e34b52c80d8bb600f88c12ef8002a80bf4ed316909659b15d7eb
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b