Analysis
-
max time kernel
70s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 13:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
General
-
Target
1.exe
-
Size
706KB
-
MD5
cea36ea3da046afb6dec951b751bee61
-
SHA1
a27bcfa338e14b3d57b8756a1c46a9ff6db3981d
-
SHA256
eb4dde3a53673d0bb16c5d4c80cd8a17128976badd6ff2aa5010364c42e1091f
-
SHA512
a4b31771f96f1452d3876ec42296a248897c7b0bc641e392ab4a3fd89c1c0549bebeeb13bf07238ff74665ef27fb5afab69b51bc95c8e3904c8d855a2fcf7946
-
SSDEEP
12288:Le0Lq+QD96jt6dFlCQcxBc1Jp7psZ1TN3Br8OQpE3G5WkFJsUP8H7m:q0LhQPQvoKZa
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Test1
C2
147.185.221.18:62592
Mutex
testing1
Attributes
-
delay
3
-
install
true
-
install_file
1.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
resource yara_rule behavioral2/memory/1884-6-0x0000000000400000-0x0000000000418000-memory.dmp VenomRAT -
Venomrat family
-
Executes dropped EXE 2 IoCs
pid Process 4720 1.exe 4608 1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\666999666 = "C:\\Users\\Public\\Documents\\1.exe" 1.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4092 set thread context of 1884 4092 1.exe 99 PID 4720 set thread context of 4608 4720 1.exe 104 -
Program crash 2 IoCs
pid pid_target Process procid_target 4968 1884 WerFault.exe 99 3232 4608 WerFault.exe 104 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe 4092 1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4092 1.exe Token: SeDebugPrivilege 4720 1.exe Token: SeDebugPrivilege 1884 1.exe Token: SeIncreaseQuotaPrivilege 1884 1.exe Token: SeSecurityPrivilege 1884 1.exe Token: SeTakeOwnershipPrivilege 1884 1.exe Token: SeLoadDriverPrivilege 1884 1.exe Token: SeSystemProfilePrivilege 1884 1.exe Token: SeSystemtimePrivilege 1884 1.exe Token: SeProfSingleProcessPrivilege 1884 1.exe Token: SeIncBasePriorityPrivilege 1884 1.exe Token: SeCreatePagefilePrivilege 1884 1.exe Token: SeBackupPrivilege 1884 1.exe Token: SeRestorePrivilege 1884 1.exe Token: SeShutdownPrivilege 1884 1.exe Token: SeDebugPrivilege 1884 1.exe Token: SeSystemEnvironmentPrivilege 1884 1.exe Token: SeRemoteShutdownPrivilege 1884 1.exe Token: SeUndockPrivilege 1884 1.exe Token: SeManageVolumePrivilege 1884 1.exe Token: 33 1884 1.exe Token: 34 1884 1.exe Token: 35 1884 1.exe Token: 36 1884 1.exe Token: SeIncreaseQuotaPrivilege 1884 1.exe Token: SeSecurityPrivilege 1884 1.exe Token: SeTakeOwnershipPrivilege 1884 1.exe Token: SeLoadDriverPrivilege 1884 1.exe Token: SeSystemProfilePrivilege 1884 1.exe Token: SeSystemtimePrivilege 1884 1.exe Token: SeProfSingleProcessPrivilege 1884 1.exe Token: SeIncBasePriorityPrivilege 1884 1.exe Token: SeCreatePagefilePrivilege 1884 1.exe Token: SeBackupPrivilege 1884 1.exe Token: SeRestorePrivilege 1884 1.exe Token: SeShutdownPrivilege 1884 1.exe Token: SeDebugPrivilege 1884 1.exe Token: SeSystemEnvironmentPrivilege 1884 1.exe Token: SeRemoteShutdownPrivilege 1884 1.exe Token: SeUndockPrivilege 1884 1.exe Token: SeManageVolumePrivilege 1884 1.exe Token: 33 1884 1.exe Token: 34 1884 1.exe Token: 35 1884 1.exe Token: 36 1884 1.exe Token: SeDebugPrivilege 4608 1.exe Token: SeIncreaseQuotaPrivilege 4608 1.exe Token: SeSecurityPrivilege 4608 1.exe Token: SeTakeOwnershipPrivilege 4608 1.exe Token: SeLoadDriverPrivilege 4608 1.exe Token: SeSystemProfilePrivilege 4608 1.exe Token: SeSystemtimePrivilege 4608 1.exe Token: SeProfSingleProcessPrivilege 4608 1.exe Token: SeIncBasePriorityPrivilege 4608 1.exe Token: SeCreatePagefilePrivilege 4608 1.exe Token: SeBackupPrivilege 4608 1.exe Token: SeRestorePrivilege 4608 1.exe Token: SeShutdownPrivilege 4608 1.exe Token: SeDebugPrivilege 4608 1.exe Token: SeSystemEnvironmentPrivilege 4608 1.exe Token: SeRemoteShutdownPrivilege 4608 1.exe Token: SeUndockPrivilege 4608 1.exe Token: SeManageVolumePrivilege 4608 1.exe Token: 33 4608 1.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4092 wrote to memory of 1884 4092 1.exe 99 PID 4092 wrote to memory of 1884 4092 1.exe 99 PID 4092 wrote to memory of 1884 4092 1.exe 99 PID 4092 wrote to memory of 1884 4092 1.exe 99 PID 4092 wrote to memory of 1884 4092 1.exe 99 PID 4092 wrote to memory of 1884 4092 1.exe 99 PID 4092 wrote to memory of 1884 4092 1.exe 99 PID 4092 wrote to memory of 1884 4092 1.exe 99 PID 1496 wrote to memory of 4720 1496 cmd.exe 100 PID 1496 wrote to memory of 4720 1496 cmd.exe 100 PID 1496 wrote to memory of 4720 1496 cmd.exe 100 PID 4720 wrote to memory of 4608 4720 1.exe 104 PID 4720 wrote to memory of 4608 4720 1.exe 104 PID 4720 wrote to memory of 4608 4720 1.exe 104 PID 4720 wrote to memory of 4608 4720 1.exe 104 PID 4720 wrote to memory of 4608 4720 1.exe 104 PID 4720 wrote to memory of 4608 4720 1.exe 104 PID 4720 wrote to memory of 4608 4720 1.exe 104 PID 4720 wrote to memory of 4608 4720 1.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1884 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 13123⤵
- Program crash
PID:4968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Documents\1.exe1⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Public\Documents\1.exeC:\Users\Public\Documents\1.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Public\Documents\1.exe"C:\Users\Public\Documents\1.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4608 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 13244⤵
- Program crash
PID:3232
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1884 -ip 18841⤵PID:4784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4608 -ip 46081⤵PID:3500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
517B
MD54d737622dcf53d4cf89810ec284fdf89
SHA1a71b0c3ac6b940047ca7730465c1f97342c8ca08
SHA2567d5529c9d51a138cea4ae46faa32497ccf1e55d6bd5aa43f746d413ce80fa1cb
SHA512acf53d9d2ffe5e3dd34760e3c8e138229ee9805387ddf0765266ee882268cf64f84fb4a1b79aee3f90b88b50f1a1bbf10c9ba7a1013496059b46f3abe9c859c6
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
706KB
MD5cea36ea3da046afb6dec951b751bee61
SHA1a27bcfa338e14b3d57b8756a1c46a9ff6db3981d
SHA256eb4dde3a53673d0bb16c5d4c80cd8a17128976badd6ff2aa5010364c42e1091f
SHA512a4b31771f96f1452d3876ec42296a248897c7b0bc641e392ab4a3fd89c1c0549bebeeb13bf07238ff74665ef27fb5afab69b51bc95c8e3904c8d855a2fcf7946