Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
24-06-2021 12:04
Static task
static1
Behavioral task
behavioral1
Sample
Terms and Conditions pdf.exe
Resource
win7v20210410
General
-
Target
Terms and Conditions pdf.exe
-
Size
1.1MB
-
MD5
07d781828a2e31ae1748f114c5fe9fd5
-
SHA1
e46c87bddf2227c583a2c9e30ee9984db82b32a2
-
SHA256
e6df0473885248cf7c449ac57120d90c000ee847f27452a426d4bb3e7e0fee7a
-
SHA512
43f14fb5d51f7e56a1469af96adfb7df3de06a06b58a225f020623f97d44e36f864a5b755c79dad9322edf1da3d557cc271742b77b0e5df46b3796d2003da951
Malware Config
Signatures
-
BitRAT Payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\5OOrb3GuK1FV7yti.exe family_bitrat C:\Users\Admin\AppData\Local\Temp\5OOrb3GuK1FV7yti.exe family_bitrat C:\Users\Admin\AppData\Local\Temp\5OOrb3GuK1FV7yti.exe family_bitrat C:\Users\Admin\AppData\Local\Temp\5OOrb3GuK1FV7yti.exe family_bitrat -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Unknown.dll acprotect \Users\Admin\AppData\Local\Temp\Unknown.dll acprotect -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
5OOrb3GuK1FV7yti.exe5OOrb3GuK1FV7yti.exe5OOrb3GuK1FV7yti.exepid process 384 5OOrb3GuK1FV7yti.exe 2544 5OOrb3GuK1FV7yti.exe 2208 5OOrb3GuK1FV7yti.exe -
Processes:
resource yara_rule behavioral2/memory/2544-133-0x0000000000400000-0x00000000008DC000-memory.dmp upx behavioral2/memory/2544-136-0x0000000000400000-0x00000000008DC000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
5OOrb3GuK1FV7yti.exepid process 2208 5OOrb3GuK1FV7yti.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
5OOrb3GuK1FV7yti.exepid process 384 5OOrb3GuK1FV7yti.exe 384 5OOrb3GuK1FV7yti.exe 384 5OOrb3GuK1FV7yti.exe 384 5OOrb3GuK1FV7yti.exe 384 5OOrb3GuK1FV7yti.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Terms and Conditions pdf.exe5OOrb3GuK1FV7yti.exe5OOrb3GuK1FV7yti.exedescription pid process target process PID 904 set thread context of 2188 904 Terms and Conditions pdf.exe Terms and Conditions pdf.exe PID 384 set thread context of 2544 384 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 2544 set thread context of 2208 2544 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
Terms and Conditions pdf.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Terms and Conditions pdf.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Terms and Conditions pdf.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5OOrb3GuK1FV7yti.exepid process 2208 5OOrb3GuK1FV7yti.exe 2208 5OOrb3GuK1FV7yti.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5OOrb3GuK1FV7yti.exe5OOrb3GuK1FV7yti.exedescription pid process Token: SeShutdownPrivilege 384 5OOrb3GuK1FV7yti.exe Token: SeDebugPrivilege 2208 5OOrb3GuK1FV7yti.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5OOrb3GuK1FV7yti.exepid process 384 5OOrb3GuK1FV7yti.exe 384 5OOrb3GuK1FV7yti.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
Terms and Conditions pdf.exeTerms and Conditions pdf.exe5OOrb3GuK1FV7yti.exe5OOrb3GuK1FV7yti.exedescription pid process target process PID 904 wrote to memory of 4056 904 Terms and Conditions pdf.exe schtasks.exe PID 904 wrote to memory of 4056 904 Terms and Conditions pdf.exe schtasks.exe PID 904 wrote to memory of 4056 904 Terms and Conditions pdf.exe schtasks.exe PID 904 wrote to memory of 2188 904 Terms and Conditions pdf.exe Terms and Conditions pdf.exe PID 904 wrote to memory of 2188 904 Terms and Conditions pdf.exe Terms and Conditions pdf.exe PID 904 wrote to memory of 2188 904 Terms and Conditions pdf.exe Terms and Conditions pdf.exe PID 904 wrote to memory of 2188 904 Terms and Conditions pdf.exe Terms and Conditions pdf.exe PID 904 wrote to memory of 2188 904 Terms and Conditions pdf.exe Terms and Conditions pdf.exe PID 904 wrote to memory of 2188 904 Terms and Conditions pdf.exe Terms and Conditions pdf.exe PID 904 wrote to memory of 2188 904 Terms and Conditions pdf.exe Terms and Conditions pdf.exe PID 904 wrote to memory of 2188 904 Terms and Conditions pdf.exe Terms and Conditions pdf.exe PID 904 wrote to memory of 2188 904 Terms and Conditions pdf.exe Terms and Conditions pdf.exe PID 904 wrote to memory of 2188 904 Terms and Conditions pdf.exe Terms and Conditions pdf.exe PID 904 wrote to memory of 2188 904 Terms and Conditions pdf.exe Terms and Conditions pdf.exe PID 2188 wrote to memory of 384 2188 Terms and Conditions pdf.exe 5OOrb3GuK1FV7yti.exe PID 2188 wrote to memory of 384 2188 Terms and Conditions pdf.exe 5OOrb3GuK1FV7yti.exe PID 2188 wrote to memory of 384 2188 Terms and Conditions pdf.exe 5OOrb3GuK1FV7yti.exe PID 384 wrote to memory of 2544 384 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 384 wrote to memory of 2544 384 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 384 wrote to memory of 2544 384 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 384 wrote to memory of 2544 384 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 384 wrote to memory of 2544 384 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 384 wrote to memory of 2544 384 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 384 wrote to memory of 2544 384 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 384 wrote to memory of 2544 384 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 2544 wrote to memory of 2208 2544 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 2544 wrote to memory of 2208 2544 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 2544 wrote to memory of 2208 2544 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 2544 wrote to memory of 2208 2544 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 2544 wrote to memory of 2208 2544 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 2544 wrote to memory of 2208 2544 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 2544 wrote to memory of 2208 2544 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe PID 2544 wrote to memory of 2208 2544 5OOrb3GuK1FV7yti.exe 5OOrb3GuK1FV7yti.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Terms and Conditions pdf.exe"C:\Users\Admin\AppData\Local\Temp\Terms and Conditions pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zJAQFbftkdPi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8AAD.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Terms and Conditions pdf.exe"C:\Users\Admin\AppData\Local\Temp\Terms and Conditions pdf.exe"2⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5OOrb3GuK1FV7yti.exe"C:\Users\Admin\AppData\Local\Temp\5OOrb3GuK1FV7yti.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5OOrb3GuK1FV7yti.exe-a "C:\Users\Admin\AppData\Local\aa8437ce\plg\MifvYrpF.json"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5OOrb3GuK1FV7yti.exe-a "C:\Users\Admin\AppData\Local\Temp\unk.xml"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5OOrb3GuK1FV7yti.exeMD5
e39f404f193bd1e12fac9307a43adbed
SHA1fb2e759fcb30b6e7299922e0e362f9b677162c94
SHA2566c127e6dbd6095f50768a04c8c7edab47b372cdb4672b9c5ff2c14a44b19582a
SHA512cb79c094cf29c29e113fc017a51b6f170d40f6110eb90ffade8655ac5a3dc1af4003f805bae80c52c66c9c3c70ce7652dfa34b2a3f7d5c61bd0cb196008d115b
-
C:\Users\Admin\AppData\Local\Temp\5OOrb3GuK1FV7yti.exeMD5
e39f404f193bd1e12fac9307a43adbed
SHA1fb2e759fcb30b6e7299922e0e362f9b677162c94
SHA2566c127e6dbd6095f50768a04c8c7edab47b372cdb4672b9c5ff2c14a44b19582a
SHA512cb79c094cf29c29e113fc017a51b6f170d40f6110eb90ffade8655ac5a3dc1af4003f805bae80c52c66c9c3c70ce7652dfa34b2a3f7d5c61bd0cb196008d115b
-
C:\Users\Admin\AppData\Local\Temp\5OOrb3GuK1FV7yti.exeMD5
e39f404f193bd1e12fac9307a43adbed
SHA1fb2e759fcb30b6e7299922e0e362f9b677162c94
SHA2566c127e6dbd6095f50768a04c8c7edab47b372cdb4672b9c5ff2c14a44b19582a
SHA512cb79c094cf29c29e113fc017a51b6f170d40f6110eb90ffade8655ac5a3dc1af4003f805bae80c52c66c9c3c70ce7652dfa34b2a3f7d5c61bd0cb196008d115b
-
C:\Users\Admin\AppData\Local\Temp\5OOrb3GuK1FV7yti.exeMD5
e39f404f193bd1e12fac9307a43adbed
SHA1fb2e759fcb30b6e7299922e0e362f9b677162c94
SHA2566c127e6dbd6095f50768a04c8c7edab47b372cdb4672b9c5ff2c14a44b19582a
SHA512cb79c094cf29c29e113fc017a51b6f170d40f6110eb90ffade8655ac5a3dc1af4003f805bae80c52c66c9c3c70ce7652dfa34b2a3f7d5c61bd0cb196008d115b
-
C:\Users\Admin\AppData\Local\Temp\License.XenArmorMD5
4f3bde9212e17ef18226866d6ac739b6
SHA1732733bec8314beb81437e60876ffa75e72ae6cd
SHA256212173a405c78d70f90e8ec0699a60ed2f4a9f3a8070de62eabd666c268fb174
SHA51210b7cdae0b9a7b0f8e1bfc66a60675fa9b25c523864d5ae3da243f4e6e4c5194f3bd92af57ac956157442f66414bdd3393d0a1e5ba4ef0f192561e8524d4e744
-
C:\Users\Admin\AppData\Local\Temp\License.XenArmorMD5
bf5da170f7c9a8eae88d1cb1a191ff80
SHA1dd1b991a1b03587a5d1edc94e919a2070e325610
SHA256e5d5110feb21939d82d962981aeaaafc4643b40a9b87cbed800ace82135d57cd
SHA5129e32247d8556fd6efffbf7b6b9c325652d8c4b223b0fa38020879171476a49ab1f64d8897b5d8d92b79c5484fd9d5899be26ca5f664ee1f9c2acb0857084121e
-
C:\Users\Admin\AppData\Local\Temp\Unknown.dllMD5
86114faba7e1ec4a667d2bcb2e23f024
SHA1670df6e1ba1dc6bece046e8b2e573dd36748245e
SHA256568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d
SHA512d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f
-
C:\Users\Admin\AppData\Local\Temp\tmp8AAD.tmpMD5
9af1878cb1afa82319424816ede47c6e
SHA1e2ed9a7ee9069cff8ca9bb498d823e884ddc9365
SHA2568ab0ed4f6131606c2f636a5ae4152e1ba001822e73c56eb1bbbabab05db84581
SHA51216a126c998d9e90d3327650f90059f3833096308c42c0a0ba33e71904387cd6d56aeb8228ee3734ae48a6952f7e37653220ca0fa6b1fe171a5daa4a7755a941e
-
C:\Users\Admin\AppData\Local\Temp\unk.xmlMD5
77e6621fd939338d3f19f3dd948ecf43
SHA153df8b3a76c5d6c35a99aa7759ff3bd7ec46588c
SHA2569cb90c1d5c31396519b1f6c73899c062b6ccbd9a8cfc7c0bb054fe88c7825867
SHA5126e812be4c3b958f0497f91e0eb2e8b77d4a13e2b7af750a30ec9bff3dde09a233b5510ee6333a9ab3182c11ab6c3d38789921d517449c6a03164e216cee43c4f
-
C:\Users\Admin\AppData\Local\aa8437ce\plg\MifvYrpF.jsonMD5
77e6621fd939338d3f19f3dd948ecf43
SHA153df8b3a76c5d6c35a99aa7759ff3bd7ec46588c
SHA2569cb90c1d5c31396519b1f6c73899c062b6ccbd9a8cfc7c0bb054fe88c7825867
SHA5126e812be4c3b958f0497f91e0eb2e8b77d4a13e2b7af750a30ec9bff3dde09a233b5510ee6333a9ab3182c11ab6c3d38789921d517449c6a03164e216cee43c4f
-
\Users\Admin\AppData\Local\Temp\Unknown.dllMD5
86114faba7e1ec4a667d2bcb2e23f024
SHA1670df6e1ba1dc6bece046e8b2e573dd36748245e
SHA256568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d
SHA512d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f
-
memory/384-130-0x0000000000000000-mapping.dmp
-
memory/904-121-0x0000000002AE0000-0x0000000002AE1000-memory.dmpFilesize
4KB
-
memory/904-114-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/904-124-0x00000000082F0000-0x0000000008340000-memory.dmpFilesize
320KB
-
memory/904-119-0x0000000002CC0000-0x0000000002CC1000-memory.dmpFilesize
4KB
-
memory/904-118-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/904-120-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/904-122-0x0000000005440000-0x0000000005450000-memory.dmpFilesize
64KB
-
memory/904-123-0x0000000005DD0000-0x0000000005E52000-memory.dmpFilesize
520KB
-
memory/904-116-0x0000000002BF0000-0x0000000002BF1000-memory.dmpFilesize
4KB
-
memory/904-117-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/2188-129-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2188-128-0x000000000040AE9E-mapping.dmp
-
memory/2188-127-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2208-137-0x0000000000400000-0x00000000006FE000-memory.dmpFilesize
3.0MB
-
memory/2208-138-0x00000000006FC1D0-mapping.dmp
-
memory/2208-143-0x0000000000400000-0x00000000006FE000-memory.dmpFilesize
3.0MB
-
memory/2544-136-0x0000000000400000-0x00000000008DC000-memory.dmpFilesize
4.9MB
-
memory/2544-133-0x0000000000400000-0x00000000008DC000-memory.dmpFilesize
4.9MB
-
memory/2544-134-0x00000000008D9FE0-mapping.dmp
-
memory/4056-125-0x0000000000000000-mapping.dmp