Overview

overview

10

Static

static

10

0001.exe

windows7_x64

10

0001.exe

windows10_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    11-10-2021 15:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0001.exe

  • Size

    3.8MB

  • MD5

    9c6bda87c91a4bb5b1a70a76d7fe4486

  • SHA1

    1732841f6f297ee0e596e36252c799922acc74ad

  • SHA256

    8a82d9904985c9779c317052ad31585aacdf6b745b88a5ec3a8bcb697a8e9a8d

  • SHA512

    e959b556796c9d5c152a38ab94398c5c4b23522ee2c991d7587484f7899582da485aacff67bb3e4e47d47c99f6a4d235f4ab5c05de4d41880b8d55ddef4b71ec

Score
10/10
suricata

Malware Config

Signatures

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0001.exe
    "C:\Users\Admin\AppData\Local\Temp\0001.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2032-53-0x0000000075821000-0x0000000075823000-memory.dmp
    Filesize

    8KB

    Download