Analysis
- max time kernel
148s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
31/03/2026, 14:07
General
- Target _530e501f3e0aa8a5e3a41a06b0ba4e159ea6cea258b71c644c0578b856aebddb.dll
- Size 9.3MB
- Sample260331-rfe66aa14r
- SHA256 530e501f3e0aa8a5e3a41a06b0ba4e159ea6cea258b71c644c0578b856aebddb
Malware Config
Signatures
- Detects Venon banker payload 1 IoCs
- Venon
VENON is a banking trojan with RAT-like capabilities targeting Brazilian financial users, written in Rust.
- Venon family
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Drops file in Windows directory 1 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\_530e501f3e0aa8a5e3a41a06b0ba4e159ea6cea258b71c644c0578b856aebddb.dll1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "NVIDIA Notification" /f2⤵
- Modifies registry key
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "Get-WmiObject -Namespace 'root\subscription' -Class __EventFilter -Filter \"Name='NVIDIAFilter'\" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "Get-WmiObject -Namespace 'root\subscription' -Class CommandLineEventConsumer -Filter \"Name='NVIDIAConsumer'\" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "Get-WmiObject -Namespace 'root\subscription' -Class __FilterToConsumerBinding -ErrorAction SilentlyContinue | Where-Object {$_.Filter -like '*NVIDIAFilter*'} | Remove-WmiObject -ErrorAction SilentlyContinue"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exe"schtasks" /query /tn "NVIDIA Notification Service"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "$exePath = \"$env:LOCALAPPDATA\NVIDIA Corporation\NVIDIA Notification\$env:COMPUTERNAME\NVIDIANotification.exe\"; if (Test-Path $exePath) { $action = New-ScheduledTaskAction -Execute $exePath; $trigger = New-ScheduledTaskTrigger -AtLogOn; $principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -TaskName 'NVIDIA Notification Service' -Action $action -Trigger $trigger -Principal $principal -Force }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_saag5rz4.lkx.ps1
memory/2080-44-0x0000024B1BBB0000-0x0000024B1BBBC000-memory.dmp
memory/2080-45-0x0000024B1C010000-0x0000024B1C022000-memory.dmp
memory/2908-24-0x000001C71C130000-0x000001C71C13C000-memory.dmp
memory/2908-25-0x000001C71DA90000-0x000001C71DAA2000-memory.dmp
memory/3152-46-0x00007FFD07100000-0x00007FFD07309000-memory.dmp
memory/3152-48-0x0000000004960000-0x0000000004972000-memory.dmp
memory/3152-0-0x00007FFCE7AF0000-0x00007FFCE844D000-memory.dmp
memory/3152-47-0x0000000002930000-0x000000000293C000-memory.dmp
memory/4040-1-0x00000138DCAD0000-0x00000138DCAE0000-memory.dmp
memory/4040-9-0x00000138DCB10000-0x00000138DCB32000-memory.dmp
memory/4040-2-0x00000138DCAD0000-0x00000138DCAE0000-memory.dmp
memory/4040-14-0x00000138DCA90000-0x00000138DCAA2000-memory.dmp
memory/4040-10-0x00000138DCAD0000-0x00000138DCAE0000-memory.dmp
memory/4040-13-0x00000138C4390000-0x00000138C439C000-memory.dmp
memory/4404-35-0x0000021BBAFD0000-0x0000021BBAFE2000-memory.dmp
memory/4404-34-0x0000021BBAAE0000-0x0000021BBAAEC000-memory.dmp