Overview
overview
10Static
static
Order.exe
windows7_x64
5Order.exe
windows10_x64
5????? ????...DF.exe
windows7_x64
10????? ????...DF.exe
windows10_x64
1087597.exe
windows7_x64
1087597.exe
windows10_x64
1029146c1ccd...70.exe
windows7_x64
729146c1ccd...70.exe
windows10_x64
72cc3b42957...8e.exe
windows7_x64
102cc3b42957...8e.exe
windows10_x64
10RICHIESTA ...TA.exe
windows7_x64
10RICHIESTA ...TA.exe
windows10_x64
1039c1e12e0a...25c.js
windows7_x64
139c1e12e0a...25c.js
windows10_x64
13f46e10e5f...3b.exe
windows7_x64
53f46e10e5f...3b.exe
windows10_x64
553074094ad...95dbec
linux_mipsel
685dce7a17...03.exe
windows7_x64
10685dce7a17...03.exe
windows10_x64
106c4aab4c3b...e2.exe
windows7_x64
106c4aab4c3b...e2.exe
windows10_x64
1073a52a4c60...c0.exe
windows7_x64
373a52a4c60...c0.exe
windows10_x64
3Inv_7623980.exe
windows7_x64
10Inv_7623980.exe
windows10_x64
108954739d96...a8.ps1
windows7_x64
88954739d96...a8.ps1
windows10_x64
8USD $.exe
windows7_x64
10USD $.exe
windows10_x64
1091d079d937...b9.exe
windows7_x64
91d079d937...b9.exe
windows10_x64
9706247fdb...89.exe
windows7_x64
Analysis
-
max time kernel
150s -
max time network
170s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
30-07-2021 15:25
Static task
static1
Behavioral task
behavioral1
Sample
Order.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Order.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
????? ?????? ????#454326_PDF.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
????? ?????? ????#454326_PDF.exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
87597.exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
87597.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
29146c1ccdf280c8ac9d0c861f8bd222d2d93777c8a822da4d72c64fc3f78670.exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
29146c1ccdf280c8ac9d0c861f8bd222d2d93777c8a822da4d72c64fc3f78670.exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
RICHIESTA DI OFFERTA.exe
Resource
win7v20210408
Behavioral task
behavioral12
Sample
RICHIESTA DI OFFERTA.exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
39c1e12e0ada85fa835b623a4698345bf95372bea57a7d3a5070ea1d5d5d825c.js
Resource
win7v20210408
Behavioral task
behavioral14
Sample
39c1e12e0ada85fa835b623a4698345bf95372bea57a7d3a5070ea1d5d5d825c.js
Resource
win10v20210410
Behavioral task
behavioral15
Sample
3f46e10e5fe376b995e2947d1be21955aa8341f39d80cca737109fcf2cf2bf3b.exe
Resource
win7v20210408
Behavioral task
behavioral16
Sample
3f46e10e5fe376b995e2947d1be21955aa8341f39d80cca737109fcf2cf2bf3b.exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
53074094addc55786936f3d67d7fe36554a7c4f4f96c06252ae768707295dbec
Resource
debian9-mipsel
Behavioral task
behavioral18
Sample
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe
Resource
win7v20210408
Behavioral task
behavioral19
Sample
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe
Resource
win10v20210410
Behavioral task
behavioral20
Sample
6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe
Resource
win7v20210408
Behavioral task
behavioral21
Sample
6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe
Resource
win10v20210410
Behavioral task
behavioral22
Sample
73a52a4c60d253ccdb79e5d50814d1689a49fd85f9e0a40a0dc57ba7fb54e5c0.exe
Resource
win7v20210408
Behavioral task
behavioral23
Sample
73a52a4c60d253ccdb79e5d50814d1689a49fd85f9e0a40a0dc57ba7fb54e5c0.exe
Resource
win10v20210410
Behavioral task
behavioral24
Sample
Inv_7623980.exe
Resource
win7v20210410
Behavioral task
behavioral25
Sample
Inv_7623980.exe
Resource
win10v20210408
Behavioral task
behavioral26
Sample
8954739d960eecd84aa64e657aed72d40567764023ba14e048778d0ebf24cba8.ps1
Resource
win7v20210410
Behavioral task
behavioral27
Sample
8954739d960eecd84aa64e657aed72d40567764023ba14e048778d0ebf24cba8.ps1
Resource
win10v20210408
Behavioral task
behavioral28
Sample
USD $.exe
Resource
win7v20210410
Behavioral task
behavioral29
Sample
USD $.exe
Resource
win10v20210408
Behavioral task
behavioral30
Sample
91d079d9371fa53227e4bb2207ba4d3aa4733feee607773b696779c5e87846b9.exe
Resource
win7v20210410
Behavioral task
behavioral31
Sample
91d079d9371fa53227e4bb2207ba4d3aa4733feee607773b696779c5e87846b9.exe
Resource
win10v20210410
Behavioral task
behavioral32
Sample
9706247fdb847874ca3fad6229787e37299be25d938af865a8e5b132bf313b89.exe
Resource
win7v20210408
General
-
Target
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe
-
Size
2.2MB
-
MD5
9882d9bb0a03a191d8ba9b4bc9c254c5
-
SHA1
23bbe2b78cfb4d2c1232fb48bda0dc1ea30222d6
-
SHA256
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03
-
SHA512
c3d683b765eb78dd21105096da079720a4b3abf717cb170b88059e900bd3749caf8002f125e7a0d6e4be2f4f703a5267d951af565eb4ba2a635d0233a8fdb6cc
Malware Config
Signatures
-
BitRAT Payload 3 IoCs
Processes:
resource yara_rule behavioral18/memory/624-74-0x000000000068A488-mapping.dmp family_bitrat behavioral18/memory/624-72-0x0000000000400000-0x00000000007CE000-memory.dmp family_bitrat behavioral18/memory/624-77-0x0000000000400000-0x00000000007CE000-memory.dmp family_bitrat -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exepid process 624 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 624 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 624 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 624 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exedescription pid process target process PID 748 set thread context of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exepowershell.exepid process 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 1136 powershell.exe 1136 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exepowershell.exe685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exedescription pid process Token: SeDebugPrivilege 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe Token: SeDebugPrivilege 1136 powershell.exe Token: SeDebugPrivilege 624 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe Token: SeShutdownPrivilege 624 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exepid process 624 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 624 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exeWScript.exedescription pid process target process PID 748 wrote to memory of 1720 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe WScript.exe PID 748 wrote to memory of 1720 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe WScript.exe PID 748 wrote to memory of 1720 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe WScript.exe PID 748 wrote to memory of 1720 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe WScript.exe PID 748 wrote to memory of 620 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 620 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 620 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 620 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 620 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 620 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 620 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 748 wrote to memory of 624 748 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe 685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe PID 1720 wrote to memory of 1136 1720 WScript.exe powershell.exe PID 1720 wrote to memory of 1136 1720 WScript.exe powershell.exe PID 1720 wrote to memory of 1136 1720 WScript.exe powershell.exe PID 1720 wrote to memory of 1136 1720 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe"C:\Users\Admin\AppData\Local\Temp\685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Ramerkpoygerkjyr.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mocenter\Moupdate.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exeC:\Users\Admin\AppData\Local\Temp\685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe2⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exeC:\Users\Admin\AppData\Local\Temp\685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:624
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
4c3b08d7af0401a66aa7934a5f533276
SHA1b5638475f3422d083a825a88a753db5e05666923
SHA25659f8fbd0ff79380d28c47847b14b846dd52ff36b00a08690c4cf5292b8dc5dc4
SHA5125497a31e5d47d2baa3bc43b6677fd8f35b55ed79e25bb831f5ee7c48c32e9aed9323a9b8d96dfc7ebe6ca3d3964f2d85ebaa2203a25b4b142ef2334542d87a0f