Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-10-2021 15:34
Static task
static1
Behavioral task
behavioral1
Sample
0001.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0001.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
0001.exe
-
Size
3.8MB
-
MD5
9c6bda87c91a4bb5b1a70a76d7fe4486
-
SHA1
1732841f6f297ee0e596e36252c799922acc74ad
-
SHA256
8a82d9904985c9779c317052ad31585aacdf6b745b88a5ec3a8bcb697a8e9a8d
-
SHA512
e959b556796c9d5c152a38ab94398c5c4b23522ee2c991d7587484f7899582da485aacff67bb3e4e47d47c99f6a4d235f4ab5c05de4d41880b8d55ddef4b71ec
Score
10/10
Malware Config
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
0001.exepid process 924 0001.exe 924 0001.exe 924 0001.exe 924 0001.exe 924 0001.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0001.exedescription pid process Token: SeShutdownPrivilege 924 0001.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0001.exepid process 924 0001.exe 924 0001.exe