Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-02-2021 06:39
Static task
static1
Behavioral task
behavioral1
Sample
dogovor.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
dogovor.doc
Resource
win10v20201028
General
-
Target
dogovor.doc
-
Size
8KB
-
MD5
372c2759cee22609b6b848e74eacdbc9
-
SHA1
e4e20687e2f8a8954bb11d4cdb40ce99dcb44b4d
-
SHA256
85c83d12212145e186408c1910dbc95a301a13a70e37a7a32b3e14c48c8b832b
-
SHA512
ca89e1ba5109b365355a9be780d5088c68b245974ab66033ee8b964a45a711430e99f8f4f167b555e52ebb8733b54d921b18f3736d052a55be353bc4c9009aa2
Malware Config
Signatures
-
BitRAT Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/332-15-0x0000000000400000-0x00000000007CD000-memory.dmp family_bitrat behavioral1/memory/332-16-0x0000000000689A84-mapping.dmp family_bitrat behavioral1/memory/332-19-0x0000000000400000-0x00000000007CD000-memory.dmp family_bitrat -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Unknown.dll acprotect \Users\Admin\AppData\Roaming\Unknown.dll acprotect -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 6 1976 EQNEDT32.EXE -
Executes dropped EXE 4 IoCs
Processes:
ro.exero.EXEro.exero.exepid process 760 ro.exe 332 ro.EXE 1692 ro.exe 1576 ro.exe -
Processes:
resource yara_rule behavioral1/memory/1692-22-0x0000000000400000-0x00000000008DC000-memory.dmp upx behavioral1/memory/1692-29-0x0000000000400000-0x00000000008DC000-memory.dmp upx -
Loads dropped DLL 3 IoCs
Processes:
EQNEDT32.EXEro.exepid process 1976 EQNEDT32.EXE 1976 EQNEDT32.EXE 1576 ro.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ro.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run ro.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\SdfggE4h = "C:\\Users\\Admin\\AppData\\Roaming\\Sdffghjh\\Dfghjm.exe.exe" ro.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
ro.EXEpid process 332 ro.EXE 332 ro.EXE 332 ro.EXE 332 ro.EXE 332 ro.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ro.exero.EXEro.exedescription pid process target process PID 760 set thread context of 332 760 ro.exe ro.EXE PID 332 set thread context of 1692 332 ro.EXE ro.exe PID 1692 set thread context of 1576 1692 ro.exe ro.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1932 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ro.exepid process 1576 ro.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ro.EXEro.exedescription pid process Token: SeDebugPrivilege 332 ro.EXE Token: SeShutdownPrivilege 332 ro.EXE Token: SeDebugPrivilege 1576 ro.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
WINWORD.EXEro.exero.EXEpid process 1932 WINWORD.EXE 1932 WINWORD.EXE 760 ro.exe 332 ro.EXE 332 ro.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
EQNEDT32.EXEro.exero.EXEro.exedescription pid process target process PID 1976 wrote to memory of 760 1976 EQNEDT32.EXE ro.exe PID 1976 wrote to memory of 760 1976 EQNEDT32.EXE ro.exe PID 1976 wrote to memory of 760 1976 EQNEDT32.EXE ro.exe PID 1976 wrote to memory of 760 1976 EQNEDT32.EXE ro.exe PID 760 wrote to memory of 332 760 ro.exe ro.EXE PID 760 wrote to memory of 332 760 ro.exe ro.EXE PID 760 wrote to memory of 332 760 ro.exe ro.EXE PID 760 wrote to memory of 332 760 ro.exe ro.EXE PID 760 wrote to memory of 332 760 ro.exe ro.EXE PID 760 wrote to memory of 332 760 ro.exe ro.EXE PID 760 wrote to memory of 332 760 ro.exe ro.EXE PID 760 wrote to memory of 332 760 ro.exe ro.EXE PID 760 wrote to memory of 332 760 ro.exe ro.EXE PID 760 wrote to memory of 332 760 ro.exe ro.EXE PID 760 wrote to memory of 332 760 ro.exe ro.EXE PID 760 wrote to memory of 332 760 ro.exe ro.EXE PID 332 wrote to memory of 1692 332 ro.EXE ro.exe PID 332 wrote to memory of 1692 332 ro.EXE ro.exe PID 332 wrote to memory of 1692 332 ro.EXE ro.exe PID 332 wrote to memory of 1692 332 ro.EXE ro.exe PID 332 wrote to memory of 1692 332 ro.EXE ro.exe PID 332 wrote to memory of 1692 332 ro.EXE ro.exe PID 332 wrote to memory of 1692 332 ro.EXE ro.exe PID 332 wrote to memory of 1692 332 ro.EXE ro.exe PID 1692 wrote to memory of 1576 1692 ro.exe ro.exe PID 1692 wrote to memory of 1576 1692 ro.exe ro.exe PID 1692 wrote to memory of 1576 1692 ro.exe ro.exe PID 1692 wrote to memory of 1576 1692 ro.exe ro.exe PID 1692 wrote to memory of 1576 1692 ro.exe ro.exe PID 1692 wrote to memory of 1576 1692 ro.exe ro.exe PID 1692 wrote to memory of 1576 1692 ro.exe ro.exe PID 1692 wrote to memory of 1576 1692 ro.exe ro.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\dogovor.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1932
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Roaming\ro.exe"C:\Users\Admin\AppData\Roaming\ro.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Roaming\ro.EXE"C:\Users\Admin\AppData\Roaming\ro.EXE"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Roaming\ro.exe-a "C:\Users\Admin\AppData\Local\ca4ef769\plg\aHRFXPfH.json"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Roaming\ro.exe-a "C:\Users\Admin\AppData\Local\Temp\unk.xml"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1576
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\unk.xmlMD5
67efe59fbf8aaf3e8de7d67dab21c2a7
SHA10869d3ea3b16639ed4a0803acea1c476e199b16c
SHA25663ca5c5c3cf4be4765115926225c060d89ef54d6f6fc3ec284cb3ecb398b0cb1
SHA51275f162ff2cc23dd7df018109264f157727fdecc869e3f493e4d0bed26b4429ab00fc9724a5ea420488ba1b4b102a07992357c0d3567c7acea6dd5333cd8cebbb
-
C:\Users\Admin\AppData\Local\ca4ef769\plg\aHRFXPfH.jsonMD5
67efe59fbf8aaf3e8de7d67dab21c2a7
SHA10869d3ea3b16639ed4a0803acea1c476e199b16c
SHA25663ca5c5c3cf4be4765115926225c060d89ef54d6f6fc3ec284cb3ecb398b0cb1
SHA51275f162ff2cc23dd7df018109264f157727fdecc869e3f493e4d0bed26b4429ab00fc9724a5ea420488ba1b4b102a07992357c0d3567c7acea6dd5333cd8cebbb
-
C:\Users\Admin\AppData\Roaming\License.XenArmorMD5
4f3bde9212e17ef18226866d6ac739b6
SHA1732733bec8314beb81437e60876ffa75e72ae6cd
SHA256212173a405c78d70f90e8ec0699a60ed2f4a9f3a8070de62eabd666c268fb174
SHA51210b7cdae0b9a7b0f8e1bfc66a60675fa9b25c523864d5ae3da243f4e6e4c5194f3bd92af57ac956157442f66414bdd3393d0a1e5ba4ef0f192561e8524d4e744
-
C:\Users\Admin\AppData\Roaming\License.XenArmorMD5
bf5da170f7c9a8eae88d1cb1a191ff80
SHA1dd1b991a1b03587a5d1edc94e919a2070e325610
SHA256e5d5110feb21939d82d962981aeaaafc4643b40a9b87cbed800ace82135d57cd
SHA5129e32247d8556fd6efffbf7b6b9c325652d8c4b223b0fa38020879171476a49ab1f64d8897b5d8d92b79c5484fd9d5899be26ca5f664ee1f9c2acb0857084121e
-
C:\Users\Admin\AppData\Roaming\Unknown.dllMD5
86114faba7e1ec4a667d2bcb2e23f024
SHA1670df6e1ba1dc6bece046e8b2e573dd36748245e
SHA256568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d
SHA512d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f
-
C:\Users\Admin\AppData\Roaming\ro.EXEMD5
d0946249b861c18765875f25655f19ed
SHA11c291d536eb64bce28094c0940e24985596ae992
SHA256c482ebed5672bdbc0cca51b79bbb7babaa82a678142d981a7dd009ad813c20d7
SHA51275d7b63cac5b69b6ebcebb48c405dfc0082c9989d3d0c0235e8c1c6537d3da7755979ffe44d5e89dfcbb1f10e13bc7943f3380e7ef9cf5a9d07651eb0dcd9082
-
C:\Users\Admin\AppData\Roaming\ro.exeMD5
d0946249b861c18765875f25655f19ed
SHA11c291d536eb64bce28094c0940e24985596ae992
SHA256c482ebed5672bdbc0cca51b79bbb7babaa82a678142d981a7dd009ad813c20d7
SHA51275d7b63cac5b69b6ebcebb48c405dfc0082c9989d3d0c0235e8c1c6537d3da7755979ffe44d5e89dfcbb1f10e13bc7943f3380e7ef9cf5a9d07651eb0dcd9082
-
C:\Users\Admin\AppData\Roaming\ro.exeMD5
d0946249b861c18765875f25655f19ed
SHA11c291d536eb64bce28094c0940e24985596ae992
SHA256c482ebed5672bdbc0cca51b79bbb7babaa82a678142d981a7dd009ad813c20d7
SHA51275d7b63cac5b69b6ebcebb48c405dfc0082c9989d3d0c0235e8c1c6537d3da7755979ffe44d5e89dfcbb1f10e13bc7943f3380e7ef9cf5a9d07651eb0dcd9082
-
C:\Users\Admin\AppData\Roaming\ro.exeMD5
d0946249b861c18765875f25655f19ed
SHA11c291d536eb64bce28094c0940e24985596ae992
SHA256c482ebed5672bdbc0cca51b79bbb7babaa82a678142d981a7dd009ad813c20d7
SHA51275d7b63cac5b69b6ebcebb48c405dfc0082c9989d3d0c0235e8c1c6537d3da7755979ffe44d5e89dfcbb1f10e13bc7943f3380e7ef9cf5a9d07651eb0dcd9082
-
C:\Users\Admin\AppData\Roaming\ro.exeMD5
d0946249b861c18765875f25655f19ed
SHA11c291d536eb64bce28094c0940e24985596ae992
SHA256c482ebed5672bdbc0cca51b79bbb7babaa82a678142d981a7dd009ad813c20d7
SHA51275d7b63cac5b69b6ebcebb48c405dfc0082c9989d3d0c0235e8c1c6537d3da7755979ffe44d5e89dfcbb1f10e13bc7943f3380e7ef9cf5a9d07651eb0dcd9082
-
\Users\Admin\AppData\Roaming\Unknown.dllMD5
86114faba7e1ec4a667d2bcb2e23f024
SHA1670df6e1ba1dc6bece046e8b2e573dd36748245e
SHA256568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d
SHA512d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f
-
\Users\Admin\AppData\Roaming\ro.exeMD5
d0946249b861c18765875f25655f19ed
SHA11c291d536eb64bce28094c0940e24985596ae992
SHA256c482ebed5672bdbc0cca51b79bbb7babaa82a678142d981a7dd009ad813c20d7
SHA51275d7b63cac5b69b6ebcebb48c405dfc0082c9989d3d0c0235e8c1c6537d3da7755979ffe44d5e89dfcbb1f10e13bc7943f3380e7ef9cf5a9d07651eb0dcd9082
-
\Users\Admin\AppData\Roaming\ro.exeMD5
d0946249b861c18765875f25655f19ed
SHA11c291d536eb64bce28094c0940e24985596ae992
SHA256c482ebed5672bdbc0cca51b79bbb7babaa82a678142d981a7dd009ad813c20d7
SHA51275d7b63cac5b69b6ebcebb48c405dfc0082c9989d3d0c0235e8c1c6537d3da7755979ffe44d5e89dfcbb1f10e13bc7943f3380e7ef9cf5a9d07651eb0dcd9082
-
memory/332-20-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/332-21-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/332-19-0x0000000000400000-0x00000000007CD000-memory.dmpFilesize
3.8MB
-
memory/332-16-0x0000000000689A84-mapping.dmp
-
memory/332-15-0x0000000000400000-0x00000000007CD000-memory.dmpFilesize
3.8MB
-
memory/760-9-0x0000000000000000-mapping.dmp
-
memory/1576-34-0x0000000000400000-0x00000000006FE000-memory.dmpFilesize
3.0MB
-
memory/1576-26-0x0000000000400000-0x00000000006FE000-memory.dmpFilesize
3.0MB
-
memory/1576-27-0x00000000006FC1D0-mapping.dmp
-
memory/1636-6-0x000007FEF5BC0000-0x000007FEF5E3A000-memory.dmpFilesize
2.5MB
-
memory/1692-29-0x0000000000400000-0x00000000008DC000-memory.dmpFilesize
4.9MB
-
memory/1692-23-0x00000000008D9FE0-mapping.dmp
-
memory/1692-22-0x0000000000400000-0x00000000008DC000-memory.dmpFilesize
4.9MB
-
memory/1932-2-0x0000000071EA1000-0x0000000071EA4000-memory.dmpFilesize
12KB
-
memory/1932-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1932-3-0x000000006F921000-0x000000006F923000-memory.dmpFilesize
8KB
-
memory/1976-5-0x00000000750C1000-0x00000000750C3000-memory.dmpFilesize
8KB