Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06-05-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
Pedido de pedido Novo projeto maio 2021PDF.sc.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Pedido de pedido Novo projeto maio 2021PDF.sc.exe
Resource
win10v20210408
General
-
Target
Pedido de pedido Novo projeto maio 2021PDF.sc.exe
-
Size
909KB
-
MD5
279b01ec826eec272cdf1bc78cc78141
-
SHA1
c56086a017b7156ecbe2d7d1edc0defe74378bb5
-
SHA256
a99a40d67018df27d1c4a0aad6b77a5985ab161480459060d5485976e70aae85
-
SHA512
3e1e4630924a5d12db4373cab980dddfe5aa4e7cc194427191b3d2a7359c7648adc39b18236e37be350a9779930942636dd2917ff41f59f27002e5aa0a434a04
Malware Config
Signatures
-
BitRAT Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1760-61-0x0000000000000000-mapping.dmp family_bitrat -
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
resource yara_rule behavioral1/memory/1760-68-0x0000000010410000-0x00000000107F4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Pedido de pedido Novo projeto maio 2021PDF.sc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Suqulu = "C:\\Users\\Public\\uluquS.url" Pedido de pedido Novo projeto maio 2021PDF.sc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
ieinstal.exepid process 1760 ieinstal.exe 1760 ieinstal.exe 1760 ieinstal.exe 1760 ieinstal.exe 1760 ieinstal.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ieinstal.exedescription pid process Token: SeDebugPrivilege 1760 ieinstal.exe Token: SeShutdownPrivilege 1760 ieinstal.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ieinstal.exepid process 1760 ieinstal.exe 1760 ieinstal.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
Pedido de pedido Novo projeto maio 2021PDF.sc.exedescription pid process target process PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe PID 1104 wrote to memory of 1760 1104 Pedido de pedido Novo projeto maio 2021PDF.sc.exe ieinstal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pedido de pedido Novo projeto maio 2021PDF.sc.exe"C:\Users\Admin\AppData\Local\Temp\Pedido de pedido Novo projeto maio 2021PDF.sc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1104-59-0x0000000076E11000-0x0000000076E13000-memory.dmpFilesize
8KB
-
memory/1104-60-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1760-61-0x0000000000000000-mapping.dmp
-
memory/1760-63-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB
-
memory/1760-67-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1760-68-0x0000000010410000-0x00000000107F4000-memory.dmpFilesize
3.9MB
-
memory/1760-69-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB