Analysis
- max time kernel
23s - max time network
67s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/07/2021, 21:31
Static task
static1
Behavioral task
behavioral1
Sample
5097AB66C01668D070E5E522A971A561.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target 5097AB66C01668D070E5E522A971A561.exe
- Size 2.6MB
- Sample210705-ag3h6jdb2j
- SHA256 e64680fcc09a464e9c482987f8727df5d25ec4bbc312db6a51d557178f9ab17a
- MD5 5097ab66c01668d070e5e522a971a561
- SHA1 d140c9f54972d020ad513a9a6e88ebe6589e2cc2
- SHA512 d5bac047838d3af72649199c96f3f3291d1f34a3e34179204dfa4a9048fd9b8311813c088ce573a961e9b54807ce4e06fb275468ea4869c323635d8f2b297fbd
- MD5 SHA1 SHA512
Malware Config
Signatures
- BitRAT Payload 2 IoCs
resource yara_rule behavioral2/memory/3420-117-0x0000000000400000-0x00000000007CE000-memory.dmp family_bitrat behavioral2/memory/3420-124-0x000000000068A488-mapping.dmp family_bitrat - Loads dropped DLL 1 IoCs
pid Process 4060 5097AB66C01668D070E5E522A971A561.exe - Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 set thread context of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x000400000001ab27-116.dat nsis_installer_1 behavioral2/files/0x000400000001ab27-116.dat nsis_installer_2 - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79 PID 4060 wrote to memory of 3420 4060 5097AB66C01668D070E5E522A971A561.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\5097AB66C01668D070E5E522A971A561.exe"C:\Users\Admin\AppData\Local\Temp\5097AB66C01668D070E5E522A971A561.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\WerFault.exe"C:\Windows\System32\WerFault.exe"2⤵PID:3420
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵PID:3772