VenomRAT - ClientAny.exe

Dynamic Analysis

Before starting the analysis, it is useful to recall what is already known that might influence the observations:

• First of all, it is expected to perform anti-analysis techniques, including checking the presence of Process Hacker. This means that Process Hacker will simply not be used until there is a need to actually stop the sample from running.
• Second, the queries that are executed against the operating system are probably going to stop the sample if a device characteristic does not match, so some extra work may be needed to make the sample “happy”.

In terms of capabilities to monitor, the following are relevant:

• keylogging usually implies the creation of a temporary file where the keystrokes are saved, or sending them directly over the network. In both cases, having Wireshark enabled provides good insights.
• there are files that the sample might be creating; those warrant inspection.
• the sample will create a new scheduled task.

To limit interaction with tools that may be detected by the malware, only Procmon will be executed on Windows. Wireshark and INetSim will be running on REMnux.

The first execution is carried out as a standard user.