Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
01/03/2025, 03:42
Behavioral task
behavioral1
Sample
7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe
Resource
win7-20241010-en
General
-
Target
7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe
-
Size
74KB
-
MD5
28451edba09329874ef2b0cf2ac0abbc
-
SHA1
24b28e2e55d1bb3f8abb7880b904dce0048e4deb
-
SHA256
7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19
-
SHA512
ef680dc166c2324aaec9abed0153ca365d23b308124531da410d39a127bffc583696095e85ab90a75168121ff1b0b96a921bb56eb2727ffa55898c6d557a90ce
-
SSDEEP
1536:HUN8cxQFvCr6PMVWe9VdQuDI6H1bf/XyCjoIQzcYh6VclN:HUOcxQxs6PMVWe9VdQsH1bfPbvQNhIY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Eulen
Microsoft_Sync_Manager
-
delay
1
-
install
true
-
install_file
DiscordHelper.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/KnhCGRrn
Signatures
-
Asyncrat family
-
resource yara_rule behavioral2/memory/396-0-0x0000000000E40000-0x0000000000E58000-memory.dmp VenomRAT -
Venomrat family
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeIncreaseQuotaPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeSecurityPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeTakeOwnershipPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeLoadDriverPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeSystemProfilePrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeSystemtimePrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeProfSingleProcessPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeIncBasePriorityPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeCreatePagefilePrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeBackupPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeRestorePrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeShutdownPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeDebugPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeSystemEnvironmentPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeRemoteShutdownPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeUndockPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeManageVolumePrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: 33 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: 34 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: 35 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: 36 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeIncreaseQuotaPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeSecurityPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeTakeOwnershipPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeLoadDriverPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeSystemProfilePrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeSystemtimePrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeProfSingleProcessPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeIncBasePriorityPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeCreatePagefilePrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeBackupPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeRestorePrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeShutdownPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeDebugPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeSystemEnvironmentPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeRemoteShutdownPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeUndockPrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: SeManageVolumePrivilege 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: 33 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: 34 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: 35 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe Token: 36 396 7bc05df6cbd9604ae4391bbabaedc7e354d0f9442ece56f73cc44b4d20cf5e19.exe