Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
20-12-2021 09:06
Static task
static1
Behavioral task
behavioral1
Sample
tts_211.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
tts_211.exe
-
Size
1.8MB
-
MD5
9a468b8d65c5e178f7f102aba60c098c
-
SHA1
b8ab231f494f2c158f433b1c213ef557492b5148
-
SHA256
41ae4a22dbe73a3263a6556f0dd96a1e12909b23b69c9f93f3e86a5821aaa0ed
-
SHA512
838c16f2942e1b0796e7ff440c6dd1f3e0266ab0d1ce0cb78798388aa13bff3c28d0ce8ffa13f202d3bbfaeedf15a722f04315f3ef6d2efb624fb342a25d84cb
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
volc.ddns.net:21501
Attributes
-
communication_password
d57285fa81b86687bf3a97dc3255ad98
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Processes:
resource yara_rule behavioral2/memory/3880-121-0x00000000056D0000-0x0000000005842000-memory.dmp upx behavioral2/memory/1140-130-0x0000000000400000-0x00000000007E5000-memory.dmp upx behavioral2/memory/1140-134-0x0000000000400000-0x00000000007E5000-memory.dmp upx behavioral2/memory/1140-135-0x0000000000400000-0x00000000007E5000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
csc.exepid process 1140 csc.exe 1140 csc.exe 1140 csc.exe 1140 csc.exe 1140 csc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tts_211.exedescription pid process target process PID 3880 set thread context of 1140 3880 tts_211.exe csc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
tts_211.exepid process 3880 tts_211.exe 3880 tts_211.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tts_211.execsc.exedescription pid process Token: SeDebugPrivilege 3880 tts_211.exe Token: SeShutdownPrivilege 1140 csc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
csc.exepid process 1140 csc.exe 1140 csc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
tts_211.exedescription pid process target process PID 3880 wrote to memory of 376 3880 tts_211.exe ngen.exe PID 3880 wrote to memory of 376 3880 tts_211.exe ngen.exe PID 3880 wrote to memory of 376 3880 tts_211.exe ngen.exe PID 3880 wrote to memory of 1140 3880 tts_211.exe csc.exe PID 3880 wrote to memory of 1140 3880 tts_211.exe csc.exe PID 3880 wrote to memory of 1140 3880 tts_211.exe csc.exe PID 3880 wrote to memory of 1140 3880 tts_211.exe csc.exe PID 3880 wrote to memory of 1140 3880 tts_211.exe csc.exe PID 3880 wrote to memory of 1140 3880 tts_211.exe csc.exe PID 3880 wrote to memory of 1140 3880 tts_211.exe csc.exe PID 3880 wrote to memory of 1140 3880 tts_211.exe csc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tts_211.exe"C:\Users\Admin\AppData\Local\Temp\tts_211.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1140-130-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/1140-135-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/1140-134-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/1140-133-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/1140-132-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/1140-131-0x00000000007E2730-mapping.dmp
-
memory/3880-120-0x0000000005270000-0x0000000005473000-memory.dmpFilesize
2.0MB
-
memory/3880-129-0x0000000005940000-0x0000000005B53000-memory.dmpFilesize
2.1MB
-
memory/3880-124-0x00000000048E0000-0x00000000048EC000-memory.dmpFilesize
48KB
-
memory/3880-125-0x0000000005880000-0x0000000005881000-memory.dmpFilesize
4KB
-
memory/3880-126-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3880-127-0x0000000004940000-0x000000000494B000-memory.dmpFilesize
44KB
-
memory/3880-128-0x00000000057C0000-0x00000000057C1000-memory.dmpFilesize
4KB
-
memory/3880-122-0x00000000048E0000-0x0000000004903000-memory.dmpFilesize
140KB
-
memory/3880-121-0x00000000056D0000-0x0000000005842000-memory.dmpFilesize
1.4MB
-
memory/3880-115-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/3880-119-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/3880-118-0x0000000004FC0000-0x0000000005163000-memory.dmpFilesize
1.6MB
-
memory/3880-117-0x0000000004DC0000-0x0000000004DC3000-memory.dmpFilesize
12KB
-
memory/3880-116-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB