Analysis
- max time kernel
118s - max time network
127s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
17/10/2021, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
- Target Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe
- Size 929KB
- Sample211017-h2ps2sdcal
- SHA256 67c445ff181fcaa6b46a1d1af78a9df1ac413593f29561e4fa43059c7ed85ace
- MD5 eb73ed3adb2b931ec9c443eced555f68
- SHA1 91a4c24a614e69f009968c5991cff82d382ef999
- SHA512 3f5ff393de2f13a874e50f678452476dedc8b8a8d4b7b7ccfed6889b7e525b54b0ac8c3b84ce22f82771d9f44ffc84fa1528641755f61167345cbd1917b7d868
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- BitRAT Payload 2 IoCs
resource yara_rule behavioral1/memory/1076-77-0x0000000072480000-0x0000000072864000-memory.dmp family_bitrat behavioral1/memory/1076-89-0x0000000072480000-0x0000000072864000-memory.dmp family_bitrat -
resource yara_rule behavioral1/memory/1076-77-0x0000000072480000-0x0000000072864000-memory.dmp upx behavioral1/memory/1076-89-0x0000000072480000-0x0000000072864000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\Vdslzs = "C:\\Users\\Public\\Libraries\\szlsdV.url" Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1076 secinit.exe 1076 secinit.exe 1076 secinit.exe 1076 secinit.exe 1076 secinit.exe - Modifies registry key 1 TTPs 3 IoCs
pid Process 1064 reg.exe 1472 reg.exe 1624 reg.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1076 secinit.exe Token: SeShutdownPrivilege 1076 secinit.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1076 secinit.exe 1076 secinit.exe - Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 1076 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 29 PID 1520 wrote to memory of 840 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 30 PID 1520 wrote to memory of 840 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 30 PID 1520 wrote to memory of 840 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 30 PID 1520 wrote to memory of 840 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 30 PID 840 wrote to memory of 1056 840 cmd.exe 32 PID 840 wrote to memory of 1056 840 cmd.exe 32 PID 840 wrote to memory of 1056 840 cmd.exe 32 PID 840 wrote to memory of 1056 840 cmd.exe 32 PID 1056 wrote to memory of 1064 1056 cmd.exe 34 PID 1056 wrote to memory of 1064 1056 cmd.exe 34 PID 1056 wrote to memory of 1064 1056 cmd.exe 34 PID 1056 wrote to memory of 1064 1056 cmd.exe 34 PID 1056 wrote to memory of 1472 1056 cmd.exe 35 PID 1056 wrote to memory of 1472 1056 cmd.exe 35 PID 1056 wrote to memory of 1472 1056 cmd.exe 35 PID 1056 wrote to memory of 1472 1056 cmd.exe 35 PID 1056 wrote to memory of 1184 1056 cmd.exe 36 PID 1056 wrote to memory of 1184 1056 cmd.exe 36 PID 1056 wrote to memory of 1184 1056 cmd.exe 36 PID 1056 wrote to memory of 1184 1056 cmd.exe 36 PID 1520 wrote to memory of 1756 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 37 PID 1520 wrote to memory of 1756 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 37 PID 1520 wrote to memory of 1756 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 37 PID 1520 wrote to memory of 1756 1520 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 37 PID 1756 wrote to memory of 1624 1756 cmd.exe 39 PID 1756 wrote to memory of 1624 1756 cmd.exe 39 PID 1756 wrote to memory of 1624 1756 cmd.exe 39 PID 1756 wrote to memory of 1624 1756 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe"C:\Users\Admin\AppData\Local\Temp\Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\secinit.exeC:\Windows\System32\secinit.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1076
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\Trast.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:1064
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:1472
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:1184
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\nest.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f3⤵
- Modifies registry key
PID:1624
-
-