Analysis
- max time kernel
146s - max time network
140s - platform
windows10_x64 - resource
win10v20201028 - submitted
05/03/2021, 10:04
Static task
static1
Behavioral task
behavioral1
Sample
083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe
- Size 3.2MB
- Sample210305-catcja4ega
- SHA256 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89
- MD5 2db8431e25227cb5d42e8e6d5b0e3856
- SHA1 5f34eb3c4243445c92c7e4d806e3ce6be4b76a8b
- SHA512 144051e479059f559ed77a8d8635062d0c74257f34f33dacc3253cb2ef7ad954d5d043dd65e27a20bc748e5ab8c93808fbd7ef1ad51fdfa04710307484ddf59e
- MD5 SHA1 SHA512
Malware Config
Signatures
- BitRAT Payload 1 IoCs
resource yara_rule behavioral2/memory/1348-5-0x0000000000400000-0x00000000007CD000-memory.dmp family_bitrat - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\igfxMO.exe DllHost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\igfxMO.exe DllHost.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 1348 notepad.exe 1348 notepad.exe 1348 notepad.exe 1348 notepad.exe 1348 notepad.exe 1348 notepad.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1348 notepad.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1348 notepad.exe 1348 notepad.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80 PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80 PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80 PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80 PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80 PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80 PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80 PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80 PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80 PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80 PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80 PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80 PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80 PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80 PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80 PID 1048 wrote to memory of 1348 1048 083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe"C:\Users\Admin\AppData\Local\Temp\083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\notepad.exe"C:\Users\Admin\AppData\Local\Temp\083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1348
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:2768