bitrat | e11175a6771df0a22bd2fdb04e93daae3ef75539e3fb301a53fd51245a0ff256

Analysis

max time kernel
147s
max time network
150s
platform
windows10_x64
resource
win10v20210410
submitted
24/06/2021, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5ba96203fa7be66961318d47cd99f7de.exe
Size 37KB
Sample210624-cdvstr5e8n
SHA256 e11175a6771df0a22bd2fdb04e93daae3ef75539e3fb301a53fd51245a0ff256
MD5 5ba96203fa7be66961318d47cd99f7de
SHA1 a4c5ec80eead02f6e330bfb4502558282c440ba8
SHA512 daba6f8c7ef318895e34a72a0c3752467b5d12d062d72c8756ede3fecf1370eea53bdeda3eac67edaacd3c7e09ab8e5cb7b7d10d682e19d1ad777bb1c3be01f4
MD5 SHA1 SHA512

Score

10^/10

bitrat evasion trojan upx

Malware Config

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4884-263-0x00000000007E2360-mapping.dmp	family_bitrat

Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Nirsoft 6 IoCs

resource	yara_rule
behavioral2/files/0x000400000001ab65-124.dat	Nirsoft
behavioral2/files/0x000400000001ab65-125.dat	Nirsoft
behavioral2/files/0x000400000001ab65-127.dat	Nirsoft
behavioral2/files/0x000300000001ab70-241.dat	Nirsoft
behavioral2/files/0x000300000001ab70-242.dat	Nirsoft
behavioral2/files/0x000300000001ab70-244.dat	Nirsoft

Executes dropped EXE 6 IoCs

pid	Process
3680	AdvancedRun.exe
2740	AdvancedRun.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
2168	AdvancedRun.exe
4832	AdvancedRun.exe
4884	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5044-215-0x0000000000400000-0x00000000007E5000-memory.dmp	upx

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	5ba96203fa7be66961318d47cd99f7de.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	5ba96203fa7be66961318d47cd99f7de.exe

Windows security modification 2 TTPs 12 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe = "0"	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Documents\47c6a7DPI1cucTca98Ua4P0aa1kN771x80fde9Sd3d4\svchost.exe = "0"	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	5ba96203fa7be66961318d47cd99f7de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	5ba96203fa7be66961318d47cd99f7de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	5ba96203fa7be66961318d47cd99f7de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	5ba96203fa7be66961318d47cd99f7de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe = "0"	5ba96203fa7be66961318d47cd99f7de.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5ba96203fa7be66961318d47cd99f7de.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 40 IoCs

pid	Process
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
5044	5ba96203fa7be66961318d47cd99f7de.exe
5044	5ba96203fa7be66961318d47cd99f7de.exe
5044	5ba96203fa7be66961318d47cd99f7de.exe
5044	5ba96203fa7be66961318d47cd99f7de.exe
5044	5ba96203fa7be66961318d47cd99f7de.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
4884	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
5044	5ba96203fa7be66961318d47cd99f7de.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3984 set thread context of 5044	3984	5ba96203fa7be66961318d47cd99f7de.exe	101
PID 1524 set thread context of 4884	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	119

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4116	3984	WerFault.exe	29
4144	1524	WerFault.exe	91

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
3564	timeout.exe
4804	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3680	AdvancedRun.exe
3680	AdvancedRun.exe
3680	AdvancedRun.exe
3680	AdvancedRun.exe
2740	AdvancedRun.exe
2740	AdvancedRun.exe
2740	AdvancedRun.exe
2740	AdvancedRun.exe
3968	powershell.exe
1440	powershell.exe
2668	powershell.exe
3812	powershell.exe
3812	powershell.exe
3796	powershell.exe
3796	powershell.exe
412	powershell.exe
412	powershell.exe
4160	powershell.exe
4160	powershell.exe
3968	powershell.exe
3968	powershell.exe
4296	powershell.exe
4296	powershell.exe
1440	powershell.exe
1440	powershell.exe
2668	powershell.exe
2668	powershell.exe
3796	powershell.exe
3812	powershell.exe
412	powershell.exe
3968	powershell.exe
4160	powershell.exe
1440	powershell.exe
2668	powershell.exe
4296	powershell.exe
3796	powershell.exe
3812	powershell.exe
412	powershell.exe
4160	powershell.exe
4296	powershell.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
3984	5ba96203fa7be66961318d47cd99f7de.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
2168	AdvancedRun.exe
2168	AdvancedRun.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	5ba96203fa7be66961318d47cd99f7de.exe
Token: SeDebugPrivilege	3680	AdvancedRun.exe
Token: SeImpersonatePrivilege	3680	AdvancedRun.exe
Token: SeDebugPrivilege	2740	AdvancedRun.exe
Token: SeImpersonatePrivilege	2740	AdvancedRun.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeDebugPrivilege	412	powershell.exe
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeRestorePrivilege	4116	WerFault.exe
Token: SeBackupPrivilege	4116	WerFault.exe
Token: SeBackupPrivilege	4116	WerFault.exe
Token: SeDebugPrivilege	4116	WerFault.exe
Token: SeShutdownPrivilege	5044	5ba96203fa7be66961318d47cd99f7de.exe
Token: SeDebugPrivilege	2168	AdvancedRun.exe
Token: SeImpersonatePrivilege	2168	AdvancedRun.exe
Token: SeDebugPrivilege	4832	AdvancedRun.exe
Token: SeImpersonatePrivilege	4832	AdvancedRun.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeDebugPrivilege	4136	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	4144	WerFault.exe
Token: SeShutdownPrivilege	4884	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5044	5ba96203fa7be66961318d47cd99f7de.exe
5044	5ba96203fa7be66961318d47cd99f7de.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 3680	3984	5ba96203fa7be66961318d47cd99f7de.exe	78
PID 3984 wrote to memory of 3680	3984	5ba96203fa7be66961318d47cd99f7de.exe	78
PID 3984 wrote to memory of 3680	3984	5ba96203fa7be66961318d47cd99f7de.exe	78
PID 3680 wrote to memory of 2740	3680	AdvancedRun.exe	79
PID 3680 wrote to memory of 2740	3680	AdvancedRun.exe	79
PID 3680 wrote to memory of 2740	3680	AdvancedRun.exe	79
PID 3984 wrote to memory of 3968	3984	5ba96203fa7be66961318d47cd99f7de.exe	81
PID 3984 wrote to memory of 3968	3984	5ba96203fa7be66961318d47cd99f7de.exe	81
PID 3984 wrote to memory of 3968	3984	5ba96203fa7be66961318d47cd99f7de.exe	81
PID 3984 wrote to memory of 1440	3984	5ba96203fa7be66961318d47cd99f7de.exe	83
PID 3984 wrote to memory of 1440	3984	5ba96203fa7be66961318d47cd99f7de.exe	83
PID 3984 wrote to memory of 1440	3984	5ba96203fa7be66961318d47cd99f7de.exe	83
PID 3984 wrote to memory of 2668	3984	5ba96203fa7be66961318d47cd99f7de.exe	85
PID 3984 wrote to memory of 2668	3984	5ba96203fa7be66961318d47cd99f7de.exe	85
PID 3984 wrote to memory of 2668	3984	5ba96203fa7be66961318d47cd99f7de.exe	85
PID 3984 wrote to memory of 3812	3984	5ba96203fa7be66961318d47cd99f7de.exe	87
PID 3984 wrote to memory of 3812	3984	5ba96203fa7be66961318d47cd99f7de.exe	87
PID 3984 wrote to memory of 3812	3984	5ba96203fa7be66961318d47cd99f7de.exe	87
PID 3984 wrote to memory of 3796	3984	5ba96203fa7be66961318d47cd99f7de.exe	89
PID 3984 wrote to memory of 3796	3984	5ba96203fa7be66961318d47cd99f7de.exe	89
PID 3984 wrote to memory of 3796	3984	5ba96203fa7be66961318d47cd99f7de.exe	89
PID 3984 wrote to memory of 1524	3984	5ba96203fa7be66961318d47cd99f7de.exe	91
PID 3984 wrote to memory of 1524	3984	5ba96203fa7be66961318d47cd99f7de.exe	91
PID 3984 wrote to memory of 1524	3984	5ba96203fa7be66961318d47cd99f7de.exe	91
PID 3984 wrote to memory of 412	3984	5ba96203fa7be66961318d47cd99f7de.exe	92
PID 3984 wrote to memory of 412	3984	5ba96203fa7be66961318d47cd99f7de.exe	92
PID 3984 wrote to memory of 412	3984	5ba96203fa7be66961318d47cd99f7de.exe	92
PID 3984 wrote to memory of 4160	3984	5ba96203fa7be66961318d47cd99f7de.exe	94
PID 3984 wrote to memory of 4160	3984	5ba96203fa7be66961318d47cd99f7de.exe	94
PID 3984 wrote to memory of 4160	3984	5ba96203fa7be66961318d47cd99f7de.exe	94
PID 3984 wrote to memory of 4296	3984	5ba96203fa7be66961318d47cd99f7de.exe	96
PID 3984 wrote to memory of 4296	3984	5ba96203fa7be66961318d47cd99f7de.exe	96
PID 3984 wrote to memory of 4296	3984	5ba96203fa7be66961318d47cd99f7de.exe	96
PID 3984 wrote to memory of 4480	3984	5ba96203fa7be66961318d47cd99f7de.exe	98
PID 3984 wrote to memory of 4480	3984	5ba96203fa7be66961318d47cd99f7de.exe	98
PID 3984 wrote to memory of 4480	3984	5ba96203fa7be66961318d47cd99f7de.exe	98
PID 4480 wrote to memory of 4804	4480	cmd.exe	100
PID 4480 wrote to memory of 4804	4480	cmd.exe	100
PID 4480 wrote to memory of 4804	4480	cmd.exe	100
PID 3984 wrote to memory of 5044	3984	5ba96203fa7be66961318d47cd99f7de.exe	101
PID 3984 wrote to memory of 5044	3984	5ba96203fa7be66961318d47cd99f7de.exe	101
PID 3984 wrote to memory of 5044	3984	5ba96203fa7be66961318d47cd99f7de.exe	101
PID 3984 wrote to memory of 5044	3984	5ba96203fa7be66961318d47cd99f7de.exe	101
PID 3984 wrote to memory of 5044	3984	5ba96203fa7be66961318d47cd99f7de.exe	101
PID 3984 wrote to memory of 5044	3984	5ba96203fa7be66961318d47cd99f7de.exe	101
PID 3984 wrote to memory of 5044	3984	5ba96203fa7be66961318d47cd99f7de.exe	101
PID 3984 wrote to memory of 5044	3984	5ba96203fa7be66961318d47cd99f7de.exe	101
PID 1524 wrote to memory of 2168	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	104
PID 1524 wrote to memory of 2168	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	104
PID 1524 wrote to memory of 2168	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	104
PID 2168 wrote to memory of 4832	2168	AdvancedRun.exe	105
PID 2168 wrote to memory of 4832	2168	AdvancedRun.exe	105
PID 2168 wrote to memory of 4832	2168	AdvancedRun.exe	105
PID 1524 wrote to memory of 4484	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	106
PID 1524 wrote to memory of 4484	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	106
PID 1524 wrote to memory of 4484	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	106
PID 1524 wrote to memory of 4508	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	108
PID 1524 wrote to memory of 4508	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	108
PID 1524 wrote to memory of 4508	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	108
PID 1524 wrote to memory of 4984	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	110
PID 1524 wrote to memory of 4984	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	110
PID 1524 wrote to memory of 4984	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	110
PID 1524 wrote to memory of 4136	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	112
PID 1524 wrote to memory of 4136	1524	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe	112

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5ba96203fa7be66961318d47cd99f7de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe

C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe
"C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe"
1⤵
- Drops startup file
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3984
- C:\Users\Admin\AppData\Local\Temp\8b1fa9ff-5c60-48fc-b681-f2cc30bd28db\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\8b1fa9ff-5c60-48fc-b681-f2cc30bd28db\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\8b1fa9ff-5c60-48fc-b681-f2cc30bd28db\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Users\Admin\AppData\Local\Temp\8b1fa9ff-5c60-48fc-b681-f2cc30bd28db\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\8b1fa9ff-5c60-48fc-b681-f2cc30bd28db\AdvancedRun.exe" /SpecialRun 4101d8 3680
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3812
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3796
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1524
- - C:\Users\Admin\AppData\Local\Temp\d5ff0aad-a133-4e78-8321-1052e58ad3aa\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\d5ff0aad-a133-4e78-8321-1052e58ad3aa\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\d5ff0aad-a133-4e78-8321-1052e58ad3aa\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\d5ff0aad-a133-4e78-8321-1052e58ad3aa\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\d5ff0aad-a133-4e78-8321-1052e58ad3aa\AdvancedRun.exe" /SpecialRun 4101d8 2168
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4832
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe" -Force
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe" -Force
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\47c6a7DPI1cucTca98Ua4P0aa1kN771x80fde9Sd3d4\svchost.exe" -Force
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe" -Force
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\47c6a7DPI1cucTca98Ua4P0aa1kN771x80fde9Sd3d4\svchost.exe" -Force
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout 1
    3⤵
    PID:4656
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:3564
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ecf3Y067T0c85D8b6fFg4rjsT62743fDu11adcn8I4k.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 2396
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:4144
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\47c6a7DPI1cucTca98Ua4P0aa1kN771x80fde9Sd3d4\svchost.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:412
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\47c6a7DPI1cucTca98Ua4P0aa1kN771x80fde9Sd3d4\svchost.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4804
- C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe
  "C:\Users\Admin\AppData\Local\Temp\5ba96203fa7be66961318d47cd99f7de.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 2484
  2⤵
  - Drops file in Windows directory
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/412-226-0x0000000006ED3000-0x0000000006ED4000-memory.dmp

Download

memory/412-207-0x0000000006ED0000-0x0000000006ED1000-memory.dmp

Download

memory/412-224-0x000000007F5F0000-0x000000007F5F1000-memory.dmp

Download

memory/412-208-0x0000000006ED2000-0x0000000006ED3000-memory.dmp

Download

memory/1440-219-0x0000000007343000-0x0000000007344000-memory.dmp

Download

memory/1440-158-0x0000000007340000-0x0000000007341000-memory.dmp

Download

memory/1440-221-0x000000007F120000-0x000000007F121000-memory.dmp

Download

memory/1440-171-0x0000000007342000-0x0000000007343000-memory.dmp

Download

memory/1524-161-0x00000000055E0000-0x00000000055E1000-memory.dmp

Download

memory/2356-261-0x0000000007490000-0x0000000007491000-memory.dmp

Download

memory/2356-262-0x0000000007492000-0x0000000007493000-memory.dmp

Download

memory/2356-273-0x000000007EE40000-0x000000007EE41000-memory.dmp

Download

memory/2356-275-0x0000000007493000-0x0000000007494000-memory.dmp

Download

memory/2668-216-0x000000007F510000-0x000000007F511000-memory.dmp

Download

memory/2668-167-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/2668-218-0x0000000000F03000-0x0000000000F04000-memory.dmp

Download

memory/2668-175-0x0000000000F02000-0x0000000000F03000-memory.dmp

Download

memory/3796-179-0x0000000000D92000-0x0000000000D93000-memory.dmp

Download

memory/3796-227-0x0000000000D93000-0x0000000000D94000-memory.dmp

Download

memory/3796-222-0x000000007F760000-0x000000007F761000-memory.dmp

Download

memory/3796-174-0x0000000000D90000-0x0000000000D91000-memory.dmp

Download

memory/3812-228-0x0000000004E53000-0x0000000004E54000-memory.dmp

Download

memory/3812-165-0x0000000004E52000-0x0000000004E53000-memory.dmp

Download

memory/3812-162-0x0000000004E50000-0x0000000004E51000-memory.dmp

Download

memory/3812-223-0x000000007E710000-0x000000007E711000-memory.dmp

Download

memory/3968-152-0x00000000074F0000-0x00000000074F1000-memory.dmp

Download

memory/3968-134-0x0000000004A90000-0x0000000004A91000-memory.dmp

Download

memory/3968-220-0x0000000004A43000-0x0000000004A44000-memory.dmp

Download

memory/3968-156-0x0000000004A42000-0x0000000004A43000-memory.dmp

Download

memory/3968-217-0x000000007E9F0000-0x000000007E9F1000-memory.dmp

Download

memory/3968-151-0x0000000004A40000-0x0000000004A41000-memory.dmp

Download

memory/3968-136-0x0000000007770000-0x0000000007771000-memory.dmp

Download

memory/3968-166-0x0000000007590000-0x0000000007591000-memory.dmp

Download

memory/3968-172-0x0000000007F80000-0x0000000007F81000-memory.dmp

Download

memory/3968-169-0x00000000076B0000-0x00000000076B1000-memory.dmp

Download

memory/3984-182-0x0000000006DF0000-0x0000000006DF1000-memory.dmp

Download

memory/3984-122-0x0000000009060000-0x0000000009061000-memory.dmp

Download

memory/3984-116-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Download

memory/3984-121-0x0000000009560000-0x0000000009561000-memory.dmp

Download

memory/3984-117-0x0000000005080000-0x0000000005081000-memory.dmp

Download

memory/3984-114-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/3984-120-0x0000000008E80000-0x0000000009055000-memory.dmp

Download

memory/3984-119-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Download

memory/3984-118-0x0000000005600000-0x0000000005601000-memory.dmp

Download

memory/4136-271-0x000000007F150000-0x000000007F151000-memory.dmp

Download

memory/4136-274-0x0000000007543000-0x0000000007544000-memory.dmp

Download

memory/4136-260-0x0000000007542000-0x0000000007543000-memory.dmp

Download

memory/4136-259-0x0000000007540000-0x0000000007541000-memory.dmp

Download

memory/4160-229-0x0000000000E93000-0x0000000000E94000-memory.dmp

Download

memory/4160-211-0x0000000000E92000-0x0000000000E93000-memory.dmp

Download

memory/4160-210-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/4160-225-0x000000007EA90000-0x000000007EA91000-memory.dmp

Download

memory/4296-213-0x0000000006C72000-0x0000000006C73000-memory.dmp

Download

memory/4296-230-0x000000007F540000-0x000000007F541000-memory.dmp

Download

memory/4296-231-0x0000000006C73000-0x0000000006C74000-memory.dmp

Download

memory/4296-212-0x0000000006C70000-0x0000000006C71000-memory.dmp

Download

memory/4484-254-0x0000000000F52000-0x0000000000F53000-memory.dmp

Download

memory/4484-253-0x0000000000F50000-0x0000000000F51000-memory.dmp

Download

memory/4484-272-0x0000000000F53000-0x0000000000F54000-memory.dmp

Download

memory/4484-268-0x000000007EB50000-0x000000007EB51000-memory.dmp

Download

memory/4508-265-0x000000007F2A0000-0x000000007F2A1000-memory.dmp

Download

memory/4508-255-0x0000000007340000-0x0000000007341000-memory.dmp

Download

memory/4508-267-0x0000000007343000-0x0000000007344000-memory.dmp

Download

memory/4508-256-0x0000000007342000-0x0000000007343000-memory.dmp

Download

memory/4984-258-0x0000000006AD2000-0x0000000006AD3000-memory.dmp

Download

memory/4984-270-0x0000000006AD3000-0x0000000006AD4000-memory.dmp

Download

memory/4984-257-0x0000000006AD0000-0x0000000006AD1000-memory.dmp

Download

memory/4984-269-0x000000007F7C0000-0x000000007F7C1000-memory.dmp

Download

memory/5044-215-0x0000000000400000-0x00000000007E5000-memory.dmp

Download