Analysis
-
max time kernel
90s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2025, 18:25
Behavioral task
behavioral1
Sample
staffbesting.rar
Resource
win7-20240729-en
windows7-x64
9 signatures
900 seconds
General
-
Target
staffbesting.rar
-
Size
358KB
-
MD5
961e2434f73d1ea24c9e390f839a2bf7
-
SHA1
5e5127fc1fb752d41b5e4feffa720272c884ae37
-
SHA256
644bf15ecd1fe95c3c559e130a2423618235661befac49ec017197936bf5efda
-
SHA512
07d7d71d3e7ec6c94cc4733112a65f0b5c0eb112092de8ea70e5f54b2c5c2cd7002323f9bcd8f2de781114be4d70ba5b8c16fabea9d8defa939ee1d5c629f586
-
SSDEEP
6144:50+LWIOQmUayBeHhBSN44WSuyltW5T0LGycZegsXz8HAVJbXHGSB2:50+L9OQtFNmriW5ILGbZQD8HAfme2
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
Mutex
zzzxbdsybzu
Attributes
-
c2_url_file
https://paste.ee/r/COm4hFYr/0
-
delay
1
-
install
true
-
install_file
Systeam.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023b90-4.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2440 STAFFBESTING ULTIMATE.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3280 7zFM.exe 3280 7zFM.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3280 7zFM.exe 2864 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeRestorePrivilege 3280 7zFM.exe Token: 35 3280 7zFM.exe Token: SeSecurityPrivilege 3280 7zFM.exe Token: SeDebugPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeIncreaseQuotaPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeSecurityPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeTakeOwnershipPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeLoadDriverPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeSystemProfilePrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeSystemtimePrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeProfSingleProcessPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeIncBasePriorityPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeCreatePagefilePrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeBackupPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeRestorePrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeShutdownPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeDebugPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeSystemEnvironmentPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeRemoteShutdownPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeUndockPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeManageVolumePrivilege 2440 STAFFBESTING ULTIMATE.exe Token: 33 2440 STAFFBESTING ULTIMATE.exe Token: 34 2440 STAFFBESTING ULTIMATE.exe Token: 35 2440 STAFFBESTING ULTIMATE.exe Token: 36 2440 STAFFBESTING ULTIMATE.exe Token: SeIncreaseQuotaPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeSecurityPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeTakeOwnershipPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeLoadDriverPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeSystemProfilePrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeSystemtimePrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeProfSingleProcessPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeIncBasePriorityPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeCreatePagefilePrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeBackupPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeRestorePrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeShutdownPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeDebugPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeSystemEnvironmentPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeRemoteShutdownPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeUndockPrivilege 2440 STAFFBESTING ULTIMATE.exe Token: SeManageVolumePrivilege 2440 STAFFBESTING ULTIMATE.exe Token: 33 2440 STAFFBESTING ULTIMATE.exe Token: 34 2440 STAFFBESTING ULTIMATE.exe Token: 35 2440 STAFFBESTING ULTIMATE.exe Token: 36 2440 STAFFBESTING ULTIMATE.exe Token: SeDebugPrivilege 2864 taskmgr.exe Token: SeSystemProfilePrivilege 2864 taskmgr.exe Token: SeCreateGlobalPrivilege 2864 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3280 7zFM.exe 3280 7zFM.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3280 wrote to memory of 2440 3280 7zFM.exe 90 PID 3280 wrote to memory of 2440 3280 7zFM.exe 90
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\staffbesting.rar"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\7zO0DC23A97\STAFFBESTING ULTIMATE.exe"C:\Users\Admin\AppData\Local\Temp\7zO0DC23A97\STAFFBESTING ULTIMATE.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2864
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD5f199439ba1c1e5b9ac2d9f55210cbd4a
SHA19ce26a30466e732d16d840842fae2d6f1adae673
SHA256792a486598d655e04f11104c4262a6c0db8f28538799acccc7b3a169b6e533dc
SHA51296d662eec309cfec6e317007945378be5d56490d34efa0b5e44a3691d1759ebea39aad277ee6e34b52c80d8bb600f88c12ef8002a80bf4ed316909659b15d7eb