Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
17/10/2021, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
- Target Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe
- Size 929KB
- Sample211017-h2ps2sdcal
- SHA256 67c445ff181fcaa6b46a1d1af78a9df1ac413593f29561e4fa43059c7ed85ace
- MD5 eb73ed3adb2b931ec9c443eced555f68
- SHA1 91a4c24a614e69f009968c5991cff82d382ef999
- SHA512 3f5ff393de2f13a874e50f678452476dedc8b8a8d4b7b7ccfed6889b7e525b54b0ac8c3b84ce22f82771d9f44ffc84fa1528641755f61167345cbd1917b7d868
- MD5 SHA1 SHA512
Malware Config
Signatures
- BitRAT Payload 2 IoCs
resource yara_rule behavioral2/memory/3212-123-0x0000000072480000-0x0000000072864000-memory.dmp family_bitrat behavioral2/memory/3212-129-0x0000000072480000-0x0000000072864000-memory.dmp family_bitrat - ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000400000001abaf-145.dat acprotect behavioral2/files/0x000400000001abaf-146.dat acprotect -
resource yara_rule behavioral2/memory/3212-123-0x0000000072480000-0x0000000072864000-memory.dmp upx behavioral2/memory/3212-129-0x0000000072480000-0x0000000072864000-memory.dmp upx behavioral2/memory/1736-133-0x0000000000400000-0x00000000008DC000-memory.dmp upx behavioral2/memory/1736-138-0x0000000000400000-0x00000000008DC000-memory.dmp upx behavioral2/memory/1736-137-0x0000000000400000-0x00000000008DC000-memory.dmp upx - Loads dropped DLL 1 IoCs
pid Process 2008 logagent.exe - Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts logagent.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\Vdslzs = "C:\\Users\\Public\\Libraries\\szlsdV.url" Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe - Drops file in System32 directory 26 IoCs
description ioc Process File created C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-convert-l1-1-0.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-math-l1-1-0.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-utility-l1-1-0.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\mozglue.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\vcruntime140.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\nss3.dll logagent.exe File opened for modification C:\Windows\SysWOW64\External\ComponentsExt logagent.exe File created C:\Windows\SysWOW64\License.XenArmor logagent.exe File opened for modification C:\Windows\SysWOW64\License.XenArmor logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-runtime-l1-1-0.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-time-l1-1-0.dll logagent.exe File opened for modification C:\Windows\SysWOW64\External logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-conio-l1-1-0_not.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-environment-l1-1-0.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-multibyte-l1-1-0.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\freebl3.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\msvcp140.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\softokn3.dll logagent.exe File created C:\Windows\SysWOW64\Unknown.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-filesystem-l1-1-0.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-heap-l1-1-0.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-locale-l1-1-0.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-stdio-l1-1-0.dll logagent.exe File created C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-string-l1-1-0.dll logagent.exe File opened for modification C:\Windows\SysWOW64\Unknown.dll logagent.exe File created C:\Windows\SysWOW64\License.XenArmor logagent.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 3212 logagent.exe 3212 logagent.exe 3212 logagent.exe 3212 logagent.exe 3212 logagent.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3212 set thread context of 1736 3212 logagent.exe 82 PID 1736 set thread context of 2008 1736 logagent.exe 83 - Modifies registry key 1 TTPs 3 IoCs
pid Process 2064 reg.exe 1060 reg.exe 2400 reg.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2008 logagent.exe 2008 logagent.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3212 logagent.exe Token: SeDebugPrivilege 2008 logagent.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3212 logagent.exe 3212 logagent.exe - Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3212 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 70 PID 2720 wrote to memory of 3044 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 71 PID 2720 wrote to memory of 3044 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 71 PID 2720 wrote to memory of 3044 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 71 PID 3044 wrote to memory of 2200 3044 cmd.exe 73 PID 3044 wrote to memory of 2200 3044 cmd.exe 73 PID 3044 wrote to memory of 2200 3044 cmd.exe 73 PID 2200 wrote to memory of 2064 2200 cmd.exe 75 PID 2200 wrote to memory of 2064 2200 cmd.exe 75 PID 2200 wrote to memory of 2064 2200 cmd.exe 75 PID 2200 wrote to memory of 1060 2200 cmd.exe 76 PID 2200 wrote to memory of 1060 2200 cmd.exe 76 PID 2200 wrote to memory of 1060 2200 cmd.exe 76 PID 2200 wrote to memory of 612 2200 cmd.exe 77 PID 2200 wrote to memory of 612 2200 cmd.exe 77 PID 2200 wrote to memory of 612 2200 cmd.exe 77 PID 2720 wrote to memory of 1864 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 78 PID 2720 wrote to memory of 1864 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 78 PID 2720 wrote to memory of 1864 2720 Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe 78 PID 1864 wrote to memory of 2400 1864 cmd.exe 80 PID 1864 wrote to memory of 2400 1864 cmd.exe 80 PID 1864 wrote to memory of 2400 1864 cmd.exe 80 PID 3212 wrote to memory of 1736 3212 logagent.exe 82 PID 3212 wrote to memory of 1736 3212 logagent.exe 82 PID 3212 wrote to memory of 1736 3212 logagent.exe 82 PID 3212 wrote to memory of 1736 3212 logagent.exe 82 PID 3212 wrote to memory of 1736 3212 logagent.exe 82 PID 3212 wrote to memory of 1736 3212 logagent.exe 82 PID 3212 wrote to memory of 1736 3212 logagent.exe 82 PID 3212 wrote to memory of 1736 3212 logagent.exe 82 PID 1736 wrote to memory of 2008 1736 logagent.exe 83 PID 1736 wrote to memory of 2008 1736 logagent.exe 83 PID 1736 wrote to memory of 2008 1736 logagent.exe 83 PID 1736 wrote to memory of 2008 1736 logagent.exe 83 PID 1736 wrote to memory of 2008 1736 logagent.exe 83 PID 1736 wrote to memory of 2008 1736 logagent.exe 83 PID 1736 wrote to memory of 2008 1736 logagent.exe 83 PID 1736 wrote to memory of 2008 1736 logagent.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe"C:\Users\Admin\AppData\Local\Temp\Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\logagent.exe-a "C:\Users\Admin\AppData\Local\4383dbee\plg\A3Uwzd8w.json"3⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\logagent.exe-a "C:\Users\Admin\AppData\Local\Temp\unk.xml"4⤵
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2064
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:1060
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:612
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f3⤵
- Modifies registry key
PID:2400
-
-