Analysis
- max time kernel
120s - max time network
122s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
17/11/2021, 09:32
Static task
static1
Behavioral task
behavioral1
Sample
Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
- Target Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe
- Size 879KB
- Sample211117-lhmfcsehbm
- SHA256 76e7e27f4fcf15610764d121949f84e3b415376bfc5e88c08d85b613013ba87f
- MD5 f5777784733a17e0b0a517f4d80df42d
- SHA1 9f5901e7d60d3619dc27b6f7e124d0a3446c66a7
- SHA512 3072b179b0dc6c747eae77c9852f469f9e3684475c0c36c3442ef7174a3e3dafe32ff92f41f449852f2d08514ed451ab75544503891335cd67c18a8b772d27c9
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- BitRAT Payload 2 IoCs
resource yara_rule behavioral1/memory/1964-80-0x0000000072480000-0x0000000072864000-memory.dmp family_bitrat behavioral1/memory/1964-91-0x0000000072480000-0x0000000072864000-memory.dmp family_bitrat - suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
resource yara_rule behavioral1/memory/1964-80-0x0000000072480000-0x0000000072864000-memory.dmp upx behavioral1/memory/1964-91-0x0000000072480000-0x0000000072864000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yhcmvzmp = "C:\\Users\\Public\\Libraries\\Yhcmvzmp\\pmzvmchY.url" Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1964 DpiScaling.exe 1964 DpiScaling.exe 1964 DpiScaling.exe 1964 DpiScaling.exe 1964 DpiScaling.exe - Modifies registry key 1 TTPs 3 IoCs
pid Process 1896 reg.exe 1524 reg.exe 884 reg.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1964 DpiScaling.exe Token: SeShutdownPrivilege 1964 DpiScaling.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1964 DpiScaling.exe 1964 DpiScaling.exe - Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1964 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 30 PID 1132 wrote to memory of 1900 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 31 PID 1132 wrote to memory of 1900 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 31 PID 1132 wrote to memory of 1900 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 31 PID 1132 wrote to memory of 1900 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 31 PID 1900 wrote to memory of 1952 1900 cmd.exe 33 PID 1900 wrote to memory of 1952 1900 cmd.exe 33 PID 1900 wrote to memory of 1952 1900 cmd.exe 33 PID 1900 wrote to memory of 1952 1900 cmd.exe 33 PID 1952 wrote to memory of 884 1952 cmd.exe 35 PID 1952 wrote to memory of 884 1952 cmd.exe 35 PID 1952 wrote to memory of 884 1952 cmd.exe 35 PID 1952 wrote to memory of 884 1952 cmd.exe 35 PID 1952 wrote to memory of 1896 1952 cmd.exe 36 PID 1952 wrote to memory of 1896 1952 cmd.exe 36 PID 1952 wrote to memory of 1896 1952 cmd.exe 36 PID 1952 wrote to memory of 1896 1952 cmd.exe 36 PID 1952 wrote to memory of 1112 1952 cmd.exe 37 PID 1952 wrote to memory of 1112 1952 cmd.exe 37 PID 1952 wrote to memory of 1112 1952 cmd.exe 37 PID 1952 wrote to memory of 1112 1952 cmd.exe 37 PID 1132 wrote to memory of 1152 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 38 PID 1132 wrote to memory of 1152 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 38 PID 1132 wrote to memory of 1152 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 38 PID 1132 wrote to memory of 1152 1132 Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe 38 PID 1152 wrote to memory of 1524 1152 cmd.exe 40 PID 1152 wrote to memory of 1524 1152 cmd.exe 40 PID 1152 wrote to memory of 1524 1152 cmd.exe 40 PID 1152 wrote to memory of 1524 1152 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe"C:\Users\Admin\AppData\Local\Temp\Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1964
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\Trast.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:884
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:1896
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:1112
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\nest.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f3⤵
- Modifies registry key
PID:1524
-
-