Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
31/03/2026, 17:34
General
- Target dc7c8f5cb67148876617f387df095dcea8598726fe5599cc1d3bab18932d372d.dll
- Size 9.3MB
- Sample260331-v5jgnafv8t
- SHA256 dc7c8f5cb67148876617f387df095dcea8598726fe5599cc1d3bab18932d372d
Malware Config
Signatures
- Detects Venon banker payload 1 IoCs
- Venon
VENON is a banking trojan with RAT-like capabilities targeting Brazilian financial users, written in Rust.
- Venon family
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Drops file in Windows directory 1 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\dc7c8f5cb67148876617f387df095dcea8598726fe5599cc1d3bab18932d372d.dll1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "NVIDIA Notification" /f2⤵
- Modifies registry key
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "Get-WmiObject -Namespace 'root\subscription' -Class __EventFilter -Filter \"Name='NVIDIAFilter'\" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "Get-WmiObject -Namespace 'root\subscription' -Class CommandLineEventConsumer -Filter \"Name='NVIDIAConsumer'\" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "Get-WmiObject -Namespace 'root\subscription' -Class __FilterToConsumerBinding -ErrorAction SilentlyContinue | Where-Object {$_.Filter -like '*NVIDIAFilter*'} | Remove-WmiObject -ErrorAction SilentlyContinue"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exe"schtasks" /query /tn "NVIDIA Notification Service"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "$exePath = \"$env:LOCALAPPDATA\NVIDIA Corporation\NVIDIA Notification\$env:COMPUTERNAME\NVIDIANotification.exe\"; if (Test-Path $exePath) { $action = New-ScheduledTaskAction -Execute $exePath; $trigger = New-ScheduledTaskTrigger -AtLogOn; $principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -TaskName 'NVIDIA Notification Service' -Action $action -Trigger $trigger -Principal $principal -Force }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_14lsszid.zbs.ps1
memory/1720-36-0x00000280CFB50000-0x00000280CFB5C000-memory.dmp
memory/1720-38-0x00000280E8180000-0x00000280E8192000-memory.dmp
memory/1720-37-0x00000280E82E0000-0x00000280E83CA000-memory.dmp
memory/3348-13-0x000002355F070000-0x000002355F07C000-memory.dmp
memory/3348-14-0x0000023577300000-0x00000235773EA000-memory.dmp
memory/3348-15-0x000002355F190000-0x000002355F1A2000-memory.dmp
memory/3348-10-0x000002355F1D0000-0x000002355F1E0000-memory.dmp
memory/3348-9-0x0000023577590000-0x00000235775B2000-memory.dmp
memory/3348-2-0x000002355F1D0000-0x000002355F1E0000-memory.dmp
memory/3348-1-0x000002355F1D0000-0x000002355F1E0000-memory.dmp
memory/3684-65-0x0000000002500000-0x00000000025EA000-memory.dmp
memory/3684-66-0x00000000045B0000-0x00000000045C2000-memory.dmp
memory/3684-64-0x0000000000CD0000-0x0000000000CDC000-memory.dmp
memory/3684-0-0x00007FF8B37C0000-0x00007FF8B411E000-memory.dmp
memory/3684-50-0x00007FF8D2EA0000-0x00007FF8D30A9000-memory.dmp
memory/3748-49-0x000001B6A3370000-0x000001B6A3382000-memory.dmp
memory/3748-48-0x000001B6BB630000-0x000001B6BB71A000-memory.dmp
memory/3748-47-0x000001B6A32A0000-0x000001B6A32AC000-memory.dmp
memory/4984-27-0x000001E746620000-0x000001E74670A000-memory.dmp
memory/4984-26-0x000001E746420000-0x000001E746432000-memory.dmp
memory/4984-25-0x000001E72DEB0000-0x000001E72DEBC000-memory.dmp