Analysis
- max time kernel
149s - max time network
179s - platform
windows7_x64 - resource
win7v20210410 - submitted
29/07/2021, 13:21
Static task
static1
Behavioral task
behavioral1
Sample
UpdatedHUD.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target UpdatedHUD.exe
- Size 25KB
- Sample210729-bfmfa9nyxn
- SHA256 ef9e853a343f1d3588eeaf60c443add28e376fd97f3bc77309b8436349b60bb3
- MD5 2c717df70f11ed8083be287522c0fc58
- SHA1 a6dd53b680819540f630a6d1319966446fb5c130
- SHA512 0593b0f629501f9be50a66d3d26cfa31c0dc4f2615b1f210e81169c1e240ab96130ad209ee06a198427d273db70a87ddc27578054ea4c878cba0430039a05d2e
- MD5 SHA1 SHA512
Malware Config
Signatures
- BitRAT Payload 3 IoCs
resource yara_rule behavioral1/memory/568-66-0x0000000000400000-0x00000000007CE000-memory.dmp family_bitrat behavioral1/memory/568-67-0x000000000068A488-mapping.dmp family_bitrat behavioral1/memory/568-69-0x0000000000400000-0x00000000007CE000-memory.dmp family_bitrat - suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdatedHUD.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdatedHUD.exe cmd.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 568 UpdatedHUD.exe 568 UpdatedHUD.exe 568 UpdatedHUD.exe 568 UpdatedHUD.exe 568 UpdatedHUD.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1724 set thread context of 568 1724 UpdatedHUD.exe 31 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe 1724 UpdatedHUD.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1724 UpdatedHUD.exe Token: SeDebugPrivilege 568 UpdatedHUD.exe Token: SeShutdownPrivilege 568 UpdatedHUD.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 568 UpdatedHUD.exe 568 UpdatedHUD.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1724 wrote to memory of 684 1724 UpdatedHUD.exe 29 PID 1724 wrote to memory of 684 1724 UpdatedHUD.exe 29 PID 1724 wrote to memory of 684 1724 UpdatedHUD.exe 29 PID 1724 wrote to memory of 684 1724 UpdatedHUD.exe 29 PID 1724 wrote to memory of 568 1724 UpdatedHUD.exe 31 PID 1724 wrote to memory of 568 1724 UpdatedHUD.exe 31 PID 1724 wrote to memory of 568 1724 UpdatedHUD.exe 31 PID 1724 wrote to memory of 568 1724 UpdatedHUD.exe 31 PID 1724 wrote to memory of 568 1724 UpdatedHUD.exe 31 PID 1724 wrote to memory of 568 1724 UpdatedHUD.exe 31 PID 1724 wrote to memory of 568 1724 UpdatedHUD.exe 31 PID 1724 wrote to memory of 568 1724 UpdatedHUD.exe 31 PID 1724 wrote to memory of 568 1724 UpdatedHUD.exe 31 PID 1724 wrote to memory of 568 1724 UpdatedHUD.exe 31 PID 1724 wrote to memory of 568 1724 UpdatedHUD.exe 31 PID 1724 wrote to memory of 568 1724 UpdatedHUD.exe 31 PID 1724 wrote to memory of 568 1724 UpdatedHUD.exe 31 PID 1724 wrote to memory of 568 1724 UpdatedHUD.exe 31 PID 1724 wrote to memory of 568 1724 UpdatedHUD.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\UpdatedHUD.exe"C:\Users\Admin\AppData\Local\Temp\UpdatedHUD.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c Copy "C:\Users\Admin\AppData\Local\Temp\UpdatedHUD.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdatedHUD.exe"2⤵
- Drops startup file
PID:684
-
-
C:\Users\Admin\AppData\Local\Temp\UpdatedHUD.exe"C:\Users\Admin\AppData\Local\Temp\UpdatedHUD.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:568
-