16b4664969ce27b9914dc9d41b5baa16a341e00f442527efffd478a73a014fa1

Target
FreeBitco.in Next Roll Prediction (Trial 1 Day).bin.exe
Size 988KB
Sample201002-tw5qn58asx
SHA256 16b4664969ce27b9914dc9d41b5baa16a341e00f442527efffd478a73a014fa1
MD5 afb30fed336e9b1e5e8ea5d941691b2a
SHA1 afeb330ea75da11608bc4f32d3490ed38cfd4c11
SHA512 f509ae85f1e0cb7d1803f5d84f43cf58ec8363e816614b1668ae7ae5bbb86547ec507776022dcb9ba3bf776837e17e72816208bb2a8e790eef0c807131b6b27a
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3044	gons.exe
3860	temp5789e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\temp5789e.exe"	InstallUtil.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3860 set thread context of 3836	3860	temp5789e.exe	77
PID 3836 set thread context of 948	3836	InstallUtil.exe	78

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	InstallUtil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3860	temp5789e.exe
Token: SeDebugPrivilege	3836	InstallUtil.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
500	FreeBitco.in Next Roll Prediction (Trial 1 Day).bin.exe
500	FreeBitco.in Next Roll Prediction (Trial 1 Day).bin.exe
500	FreeBitco.in Next Roll Prediction (Trial 1 Day).bin.exe
500	FreeBitco.in Next Roll Prediction (Trial 1 Day).bin.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
500	FreeBitco.in Next Roll Prediction (Trial 1 Day).bin.exe
500	FreeBitco.in Next Roll Prediction (Trial 1 Day).bin.exe
500	FreeBitco.in Next Roll Prediction (Trial 1 Day).bin.exe
500	FreeBitco.in Next Roll Prediction (Trial 1 Day).bin.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 500 wrote to memory of 3044	500	FreeBitco.in Next Roll Prediction (Trial 1 Day).bin.exe	72
PID 500 wrote to memory of 3044	500	FreeBitco.in Next Roll Prediction (Trial 1 Day).bin.exe	72
PID 500 wrote to memory of 3860	500	FreeBitco.in Next Roll Prediction (Trial 1 Day).bin.exe	73
PID 500 wrote to memory of 3860	500	FreeBitco.in Next Roll Prediction (Trial 1 Day).bin.exe	73
PID 3860 wrote to memory of 3836	3860	temp5789e.exe	77
PID 3860 wrote to memory of 3836	3860	temp5789e.exe	77
PID 3860 wrote to memory of 3836	3860	temp5789e.exe	77
PID 3860 wrote to memory of 3836	3860	temp5789e.exe	77
PID 3860 wrote to memory of 3836	3860	temp5789e.exe	77
PID 3860 wrote to memory of 3836	3860	temp5789e.exe	77
PID 3860 wrote to memory of 3836	3860	temp5789e.exe	77
PID 3860 wrote to memory of 3836	3860	temp5789e.exe	77
PID 3836 wrote to memory of 948	3836	InstallUtil.exe	78
PID 3836 wrote to memory of 948	3836	InstallUtil.exe	78
PID 3836 wrote to memory of 948	3836	InstallUtil.exe	78
PID 3836 wrote to memory of 948	3836	InstallUtil.exe	78
PID 3836 wrote to memory of 948	3836	InstallUtil.exe	78
PID 3836 wrote to memory of 948	3836	InstallUtil.exe	78
PID 3836 wrote to memory of 948	3836	InstallUtil.exe	78
PID 3836 wrote to memory of 948	3836	InstallUtil.exe	78

C:\Users\Admin\AppData\Local\Temp\FreeBitco.in Next Roll Prediction (Trial 1 Day).bin.exe
"C:\Users\Admin\AppData\Local\Temp\FreeBitco.in Next Roll Prediction (Trial 1 Day).bin.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:500
- C:\Users\Admin\AppData\Roaming\Microsoft\gons.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\gons.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Users\Admin\AppData\Roaming\Microsoft\temp5789e.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\temp5789e.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-25-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/948-30-0x0000000005170000-0x0000000005171000-memory.dmp

Download

memory/948-28-0x0000000073D10000-0x00000000743FE000-memory.dmp

Download

memory/3044-12-0x000000001FD30000-0x000000001FD31000-memory.dmp

Download

memory/3044-5-0x00007FFF56F10000-0x00007FFF578FC000-memory.dmp

Download

memory/3044-9-0x0000000000D30000-0x0000000000D31000-memory.dmp

Download

memory/3836-21-0x0000000005F90000-0x0000000005F91000-memory.dmp

Download

memory/3836-16-0x0000000073D10000-0x00000000743FE000-memory.dmp

Download

memory/3836-19-0x0000000005830000-0x0000000005831000-memory.dmp

Download

memory/3836-24-0x00000000058D0000-0x00000000058D1000-memory.dmp

Download

memory/3836-14-0x0000000000400000-0x000000000049A000-memory.dmp

Download

memory/3860-8-0x0000000000370000-0x0000000000371000-memory.dmp

Download

memory/3860-7-0x00007FFF56F10000-0x00007FFF578FC000-memory.dmp

Download

memory/3860-13-0x0000000000B40000-0x0000000000B50000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads