Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-12-2021 09:06
Static task
static1
Behavioral task
behavioral1
Sample
tts_211.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
tts_211.exe
-
Size
1.8MB
-
MD5
9a468b8d65c5e178f7f102aba60c098c
-
SHA1
b8ab231f494f2c158f433b1c213ef557492b5148
-
SHA256
41ae4a22dbe73a3263a6556f0dd96a1e12909b23b69c9f93f3e86a5821aaa0ed
-
SHA512
838c16f2942e1b0796e7ff440c6dd1f3e0266ab0d1ce0cb78798388aa13bff3c28d0ce8ffa13f202d3bbfaeedf15a722f04315f3ef6d2efb624fb342a25d84cb
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
volc.ddns.net:21501
Attributes
-
communication_password
d57285fa81b86687bf3a97dc3255ad98
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Processes:
resource yara_rule behavioral1/memory/1908-59-0x00000000048C0000-0x0000000004A32000-memory.dmp upx behavioral1/memory/316-67-0x0000000000400000-0x00000000007E5000-memory.dmp upx behavioral1/memory/316-68-0x0000000000400000-0x00000000007E5000-memory.dmp upx behavioral1/memory/316-69-0x0000000000400000-0x00000000007E5000-memory.dmp upx behavioral1/memory/316-70-0x0000000000400000-0x00000000007E5000-memory.dmp upx behavioral1/memory/316-72-0x0000000000400000-0x00000000007E5000-memory.dmp upx behavioral1/memory/316-74-0x0000000000400000-0x00000000007E5000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
vbc.exepid process 316 vbc.exe 316 vbc.exe 316 vbc.exe 316 vbc.exe 316 vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tts_211.exedescription pid process target process PID 1908 set thread context of 316 1908 tts_211.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
tts_211.exepid process 1908 tts_211.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tts_211.exevbc.exedescription pid process Token: SeDebugPrivilege 1908 tts_211.exe Token: SeDebugPrivilege 316 vbc.exe Token: SeShutdownPrivilege 316 vbc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
vbc.exepid process 316 vbc.exe 316 vbc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
tts_211.exedescription pid process target process PID 1908 wrote to memory of 772 1908 tts_211.exe ServiceModelReg.exe PID 1908 wrote to memory of 772 1908 tts_211.exe ServiceModelReg.exe PID 1908 wrote to memory of 772 1908 tts_211.exe ServiceModelReg.exe PID 1908 wrote to memory of 772 1908 tts_211.exe ServiceModelReg.exe PID 1908 wrote to memory of 772 1908 tts_211.exe ServiceModelReg.exe PID 1908 wrote to memory of 772 1908 tts_211.exe ServiceModelReg.exe PID 1908 wrote to memory of 772 1908 tts_211.exe ServiceModelReg.exe PID 1908 wrote to memory of 316 1908 tts_211.exe vbc.exe PID 1908 wrote to memory of 316 1908 tts_211.exe vbc.exe PID 1908 wrote to memory of 316 1908 tts_211.exe vbc.exe PID 1908 wrote to memory of 316 1908 tts_211.exe vbc.exe PID 1908 wrote to memory of 316 1908 tts_211.exe vbc.exe PID 1908 wrote to memory of 316 1908 tts_211.exe vbc.exe PID 1908 wrote to memory of 316 1908 tts_211.exe vbc.exe PID 1908 wrote to memory of 316 1908 tts_211.exe vbc.exe PID 1908 wrote to memory of 316 1908 tts_211.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tts_211.exe"C:\Users\Admin\AppData\Local\Temp\tts_211.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-66-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/316-74-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/316-73-0x0000000076731000-0x0000000076733000-memory.dmpFilesize
8KB
-
memory/316-72-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/316-70-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/316-71-0x00000000007E2730-mapping.dmp
-
memory/316-69-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/316-68-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/316-67-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/1908-59-0x00000000048C0000-0x0000000004A32000-memory.dmpFilesize
1.4MB
-
memory/1908-65-0x00000000076A0000-0x0000000007931000-memory.dmpFilesize
2.6MB
-
memory/1908-63-0x0000000000340000-0x0000000000377000-memory.dmpFilesize
220KB
-
memory/1908-62-0x0000000000320000-0x0000000000338000-memory.dmpFilesize
96KB
-
memory/1908-61-0x0000000000310000-0x000000000031B000-memory.dmpFilesize
44KB
-
memory/1908-60-0x0000000000300000-0x000000000030E000-memory.dmpFilesize
56KB
-
memory/1908-54-0x0000000001020000-0x0000000001021000-memory.dmpFilesize
4KB
-
memory/1908-58-0x0000000006240000-0x0000000006443000-memory.dmpFilesize
2.0MB
-
memory/1908-57-0x0000000004E20000-0x0000000004FC3000-memory.dmpFilesize
1.6MB
-
memory/1908-56-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/1908-55-0x00000000003E0000-0x00000000003E3000-memory.dmpFilesize
12KB