bitrat | e11175a6771df0a22bd2fdb04e93daae3ef75539e3fb301a53fd51245a0ff256

Analysis

max time kernel
149s
max time network
127s
platform
windows7_x64
resource
win7v20210408
submitted
24/06/2021, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5ba96203fa7be66961318d47cd99f7de.exe
Size 37KB
Sample210624-cdvstr5e8n
SHA256 e11175a6771df0a22bd2fdb04e93daae3ef75539e3fb301a53fd51245a0ff256
MD5 5ba96203fa7be66961318d47cd99f7de
SHA1 a4c5ec80eead02f6e330bfb4502558282c440ba8
SHA512 daba6f8c7ef318895e34a72a0c3752467b5d12d062d72c8756ede3fecf1370eea53bdeda3eac67edaacd3c7e09ab8e5cb7b7d10d682e19d1ad777bb1c3be01f4
MD5 SHA1 SHA512

Score

10^/10

bitrat evasion persistence trojan upx

Malware Config

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2264-135-0x00000000007E2360-mapping.dmp	family_bitrat

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Nirsoft 14 IoCs

resource	yara_rule
behavioral1/files/0x00060000000130be-64.dat	Nirsoft
behavioral1/files/0x00060000000130be-65.dat	Nirsoft
behavioral1/files/0x00060000000130be-67.dat	Nirsoft
behavioral1/files/0x00060000000130be-69.dat	Nirsoft
behavioral1/files/0x00060000000130be-70.dat	Nirsoft
behavioral1/files/0x00060000000130be-71.dat	Nirsoft
behavioral1/files/0x00060000000130be-73.dat	Nirsoft
behavioral1/files/0x00040000000130c9-199.dat	Nirsoft
behavioral1/files/0x00040000000130c9-197.dat	Nirsoft
behavioral1/files/0x00040000000130c9-196.dat	Nirsoft
behavioral1/files/0x00040000000130c9-200.dat	Nirsoft
behavioral1/files/0x00040000000130c9-201.dat	Nirsoft
behavioral1/files/0x00040000000130c9-202.dat	Nirsoft
behavioral1/files/0x00040000000130c9-204.dat	Nirsoft

Executes dropped EXE 6 IoCs

pid	Process
1444	AdvancedRun.exe
1572	AdvancedRun.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
2704	AdvancedRun.exe
2752	AdvancedRun.exe
1288	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2264-134-0x0000000000400000-0x00000000007E5000-memory.dmp	upx
behavioral1/memory/2264-143-0x0000000000400000-0x00000000007E5000-memory.dmp	upx

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	5ba96203fa7be66961318d47cd99f7de.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	5ba96203fa7be66961318d47cd99f7de.exe

Loads dropped DLL 9 IoCs

pid	Process
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
1444	AdvancedRun.exe
1444	AdvancedRun.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
2704	AdvancedRun.exe
2704	AdvancedRun.exe

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	5ba96203fa7be66961318d47cd99f7de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe = "0"	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Documents\47c6a7DPI1cucTca98Ua4P0aa1kN771x80fde9Sd3d4\svchost.exe = "0"	5ba96203fa7be66961318d47cd99f7de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	5ba96203fa7be66961318d47cd99f7de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe = "0"	5ba96203fa7be66961318d47cd99f7de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	5ba96203fa7be66961318d47cd99f7de.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k = "C:\\Users\\Public\\Documents\\47c6a7DPI1cucTca98Ua4P0aa1kN771x80fde9Sd3d4\\svchost.exe"	5ba96203fa7be66961318d47cd99f7de.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k = "C:\\Users\\Public\\Documents\\47c6a7DPI1cucTca98Ua4P0aa1kN771x80fde9Sd3d4\\svchost.exe"	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5ba96203fa7be66961318d47cd99f7de.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 37 IoCs

pid	Process
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
2264	5ba96203fa7be66961318d47cd99f7de.exe
2264	5ba96203fa7be66961318d47cd99f7de.exe
2264	5ba96203fa7be66961318d47cd99f7de.exe
2264	5ba96203fa7be66961318d47cd99f7de.exe
2264	5ba96203fa7be66961318d47cd99f7de.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1288	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
2264	5ba96203fa7be66961318d47cd99f7de.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 344 set thread context of 2264	344	5ba96203fa7be66961318d47cd99f7de.exe	51
PID 740 set thread context of 1288	740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	67

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2240	timeout.exe
2228	timeout.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
1444	AdvancedRun.exe
1444	AdvancedRun.exe
1572	AdvancedRun.exe
1572	AdvancedRun.exe
1424	powershell.exe
1548	powershell.exe
596	powershell.exe
1628	powershell.exe
984	powershell.exe
1104	powershell.exe
552	powershell.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
344	5ba96203fa7be66961318d47cd99f7de.exe
552	powershell.exe
984	powershell.exe
1104	powershell.exe
1424	powershell.exe
1628	powershell.exe
596	powershell.exe
1548	powershell.exe
2704	AdvancedRun.exe
2704	AdvancedRun.exe
2752	AdvancedRun.exe
2752	AdvancedRun.exe
2796	powershell.exe
2864	powershell.exe
2828	powershell.exe
2928	powershell.exe
2796	powershell.exe
3024	powershell.exe
2864	powershell.exe
2828	powershell.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
2928	powershell.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
3024	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	344	5ba96203fa7be66961318d47cd99f7de.exe
Token: SeDebugPrivilege	1444	AdvancedRun.exe
Token: SeImpersonatePrivilege	1444	AdvancedRun.exe
Token: SeDebugPrivilege	1572	AdvancedRun.exe
Token: SeImpersonatePrivilege	1572	AdvancedRun.exe
Token: SeDebugPrivilege	740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	596	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	552	powershell.exe
Token: SeDebugPrivilege	2264	5ba96203fa7be66961318d47cd99f7de.exe
Token: SeShutdownPrivilege	2264	5ba96203fa7be66961318d47cd99f7de.exe
Token: SeDebugPrivilege	2704	AdvancedRun.exe
Token: SeImpersonatePrivilege	2704	AdvancedRun.exe
Token: SeDebugPrivilege	2752	AdvancedRun.exe
Token: SeImpersonatePrivilege	2752	AdvancedRun.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	1288	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
Token: SeShutdownPrivilege	1288	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2264	5ba96203fa7be66961318d47cd99f7de.exe
2264	5ba96203fa7be66961318d47cd99f7de.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 1444	344	5ba96203fa7be66961318d47cd99f7de.exe	29
PID 344 wrote to memory of 1444	344	5ba96203fa7be66961318d47cd99f7de.exe	29
PID 344 wrote to memory of 1444	344	5ba96203fa7be66961318d47cd99f7de.exe	29
PID 344 wrote to memory of 1444	344	5ba96203fa7be66961318d47cd99f7de.exe	29
PID 1444 wrote to memory of 1572	1444	AdvancedRun.exe	30
PID 1444 wrote to memory of 1572	1444	AdvancedRun.exe	30
PID 1444 wrote to memory of 1572	1444	AdvancedRun.exe	30
PID 1444 wrote to memory of 1572	1444	AdvancedRun.exe	30
PID 344 wrote to memory of 552	344	5ba96203fa7be66961318d47cd99f7de.exe	31
PID 344 wrote to memory of 552	344	5ba96203fa7be66961318d47cd99f7de.exe	31
PID 344 wrote to memory of 552	344	5ba96203fa7be66961318d47cd99f7de.exe	31
PID 344 wrote to memory of 552	344	5ba96203fa7be66961318d47cd99f7de.exe	31
PID 344 wrote to memory of 1104	344	5ba96203fa7be66961318d47cd99f7de.exe	33
PID 344 wrote to memory of 1104	344	5ba96203fa7be66961318d47cd99f7de.exe	33
PID 344 wrote to memory of 1104	344	5ba96203fa7be66961318d47cd99f7de.exe	33
PID 344 wrote to memory of 1104	344	5ba96203fa7be66961318d47cd99f7de.exe	33
PID 344 wrote to memory of 596	344	5ba96203fa7be66961318d47cd99f7de.exe	35
PID 344 wrote to memory of 596	344	5ba96203fa7be66961318d47cd99f7de.exe	35
PID 344 wrote to memory of 596	344	5ba96203fa7be66961318d47cd99f7de.exe	35
PID 344 wrote to memory of 596	344	5ba96203fa7be66961318d47cd99f7de.exe	35
PID 344 wrote to memory of 1548	344	5ba96203fa7be66961318d47cd99f7de.exe	36
PID 344 wrote to memory of 1548	344	5ba96203fa7be66961318d47cd99f7de.exe	36
PID 344 wrote to memory of 1548	344	5ba96203fa7be66961318d47cd99f7de.exe	36
PID 344 wrote to memory of 1548	344	5ba96203fa7be66961318d47cd99f7de.exe	36
PID 344 wrote to memory of 1628	344	5ba96203fa7be66961318d47cd99f7de.exe	39
PID 344 wrote to memory of 1628	344	5ba96203fa7be66961318d47cd99f7de.exe	39
PID 344 wrote to memory of 1628	344	5ba96203fa7be66961318d47cd99f7de.exe	39
PID 344 wrote to memory of 1628	344	5ba96203fa7be66961318d47cd99f7de.exe	39
PID 344 wrote to memory of 740	344	5ba96203fa7be66961318d47cd99f7de.exe	40
PID 344 wrote to memory of 740	344	5ba96203fa7be66961318d47cd99f7de.exe	40
PID 344 wrote to memory of 740	344	5ba96203fa7be66961318d47cd99f7de.exe	40
PID 344 wrote to memory of 740	344	5ba96203fa7be66961318d47cd99f7de.exe	40
PID 344 wrote to memory of 984	344	5ba96203fa7be66961318d47cd99f7de.exe	42
PID 344 wrote to memory of 984	344	5ba96203fa7be66961318d47cd99f7de.exe	42
PID 344 wrote to memory of 984	344	5ba96203fa7be66961318d47cd99f7de.exe	42
PID 344 wrote to memory of 984	344	5ba96203fa7be66961318d47cd99f7de.exe	42
PID 344 wrote to memory of 1424	344	5ba96203fa7be66961318d47cd99f7de.exe	44
PID 344 wrote to memory of 1424	344	5ba96203fa7be66961318d47cd99f7de.exe	44
PID 344 wrote to memory of 1424	344	5ba96203fa7be66961318d47cd99f7de.exe	44
PID 344 wrote to memory of 1424	344	5ba96203fa7be66961318d47cd99f7de.exe	44
PID 344 wrote to memory of 1764	344	5ba96203fa7be66961318d47cd99f7de.exe	46
PID 344 wrote to memory of 1764	344	5ba96203fa7be66961318d47cd99f7de.exe	46
PID 344 wrote to memory of 1764	344	5ba96203fa7be66961318d47cd99f7de.exe	46
PID 344 wrote to memory of 1764	344	5ba96203fa7be66961318d47cd99f7de.exe	46
PID 344 wrote to memory of 2196	344	5ba96203fa7be66961318d47cd99f7de.exe	49
PID 344 wrote to memory of 2196	344	5ba96203fa7be66961318d47cd99f7de.exe	49
PID 344 wrote to memory of 2196	344	5ba96203fa7be66961318d47cd99f7de.exe	49
PID 344 wrote to memory of 2196	344	5ba96203fa7be66961318d47cd99f7de.exe	49
PID 2196 wrote to memory of 2240	2196	cmd.exe	50
PID 2196 wrote to memory of 2240	2196	cmd.exe	50
PID 2196 wrote to memory of 2240	2196	cmd.exe	50
PID 2196 wrote to memory of 2240	2196	cmd.exe	50
PID 344 wrote to memory of 2264	344	5ba96203fa7be66961318d47cd99f7de.exe	51
PID 344 wrote to memory of 2264	344	5ba96203fa7be66961318d47cd99f7de.exe	51
PID 344 wrote to memory of 2264	344	5ba96203fa7be66961318d47cd99f7de.exe	51
PID 344 wrote to memory of 2264	344	5ba96203fa7be66961318d47cd99f7de.exe	51
PID 344 wrote to memory of 2264	344	5ba96203fa7be66961318d47cd99f7de.exe	51
PID 344 wrote to memory of 2264	344	5ba96203fa7be66961318d47cd99f7de.exe	51
PID 344 wrote to memory of 2264	344	5ba96203fa7be66961318d47cd99f7de.exe	51
PID 344 wrote to memory of 2264	344	5ba96203fa7be66961318d47cd99f7de.exe	51
PID 344 wrote to memory of 2264	344	5ba96203fa7be66961318d47cd99f7de.exe	51
PID 740 wrote to memory of 2704	740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	52
PID 740 wrote to memory of 2704	740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	52
PID 740 wrote to memory of 2704	740	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	52

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe

C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe
"C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:344
- C:\Users\Admin\AppData\Local\Temp\7f1412a8-c147-4320-a5c7-1c08b5d8acb9\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\7f1412a8-c147-4320-a5c7-1c08b5d8acb9\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\7f1412a8-c147-4320-a5c7-1c08b5d8acb9\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Users\Admin\AppData\Local\Temp\7f1412a8-c147-4320-a5c7-1c08b5d8acb9\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\7f1412a8-c147-4320-a5c7-1c08b5d8acb9\AdvancedRun.exe" /SpecialRun 4101d8 1444
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1104
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:596
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:740
- - C:\Users\Admin\AppData\Local\Temp\1e5714fc-8fd0-4229-82c1-0631cfef9a5d\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\1e5714fc-8fd0-4229-82c1-0631cfef9a5d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\1e5714fc-8fd0-4229-82c1-0631cfef9a5d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\1e5714fc-8fd0-4229-82c1-0631cfef9a5d\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\1e5714fc-8fd0-4229-82c1-0631cfef9a5d\AdvancedRun.exe" /SpecialRun 4101d8 2704
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2752
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2796
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2828
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\47c6a7DPI1cucTca98Ua4P0aa1kN771x80fde9Sd3d4\svchost.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\47c6a7DPI1cucTca98Ua4P0aa1kN771x80fde9Sd3d4\svchost.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout 1
    3⤵
    PID:1524
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:2228
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\47c6a7DPI1cucTca98Ua4P0aa1kN771x80fde9Sd3d4\svchost.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:984
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1424
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\47c6a7DPI1cucTca98Ua4P0aa1kN771x80fde9Sd3d4\svchost.exe" -Force
  2⤵
  PID:1764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2240
- C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe
  "C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/344-60-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Download

memory/344-63-0x000000000A090000-0x000000000A265000-memory.dmp

Download

memory/344-62-0x0000000005150000-0x0000000005151000-memory.dmp

Download

memory/552-132-0x00000000048F2000-0x00000000048F3000-memory.dmp

Download

memory/552-124-0x00000000048F0000-0x00000000048F1000-memory.dmp

Download

memory/552-161-0x0000000005710000-0x0000000005711000-memory.dmp

Download

memory/552-168-0x00000000062A0000-0x00000000062A1000-memory.dmp

Download

memory/552-160-0x0000000005670000-0x0000000005671000-memory.dmp

Download

memory/552-155-0x0000000005610000-0x0000000005611000-memory.dmp

Download

memory/552-175-0x00000000055D0000-0x00000000055D1000-memory.dmp

Download

memory/552-154-0x000000007EF30000-0x000000007EF31000-memory.dmp

Download

memory/552-145-0x0000000005240000-0x0000000005241000-memory.dmp

Download

memory/596-129-0x0000000001FF0000-0x0000000002C3A000-memory.dmp

Download

memory/596-127-0x0000000001FF0000-0x0000000002C3A000-memory.dmp

Download

memory/596-137-0x0000000002670000-0x0000000002671000-memory.dmp

Download

memory/740-89-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/740-106-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/984-109-0x00000000021F0000-0x0000000002E3A000-memory.dmp

Download

memory/984-115-0x00000000021F0000-0x0000000002E3A000-memory.dmp

Download

memory/1104-100-0x00000000022C0000-0x00000000022C1000-memory.dmp

Download

memory/1104-122-0x00000000048B0000-0x00000000048B1000-memory.dmp

Download

memory/1104-133-0x00000000048B2000-0x00000000048B3000-memory.dmp

Download

memory/1424-119-0x0000000000920000-0x0000000000921000-memory.dmp

Download

memory/1424-121-0x0000000000922000-0x0000000000923000-memory.dmp

Download

memory/1444-68-0x0000000075211000-0x0000000075213000-memory.dmp

Download

memory/1548-126-0x0000000001FF0000-0x0000000002C3A000-memory.dmp

Download

memory/1628-128-0x00000000049F2000-0x00000000049F3000-memory.dmp

Download

memory/1628-123-0x00000000049F0000-0x00000000049F1000-memory.dmp

Download

memory/1628-108-0x0000000004A30000-0x0000000004A31000-memory.dmp

Download

memory/2264-143-0x0000000000400000-0x00000000007E5000-memory.dmp

Download

memory/2264-134-0x0000000000400000-0x00000000007E5000-memory.dmp

Download

memory/2796-211-0x0000000001FF0000-0x0000000002C3A000-memory.dmp

Download

memory/2828-215-0x00000000048E0000-0x00000000048E1000-memory.dmp

Download

memory/2828-219-0x00000000048E2000-0x00000000048E3000-memory.dmp

Download

memory/2864-226-0x0000000004980000-0x0000000004981000-memory.dmp

Download

memory/2864-227-0x0000000004982000-0x0000000004983000-memory.dmp

Download

memory/2928-224-0x0000000001FF0000-0x0000000002C3A000-memory.dmp

Download

memory/2928-220-0x0000000001FF0000-0x0000000002C3A000-memory.dmp

Download

memory/3024-225-0x0000000004982000-0x0000000004983000-memory.dmp

Download

memory/3024-222-0x0000000004980000-0x0000000004981000-memory.dmp

Download