Analysis
-
max time kernel
110s -
max time network
118s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30-12-2021 08:12
Static task
static1
Behavioral task
behavioral1
Sample
0b032e83c3a78f61fa3bf9cebd5a0242.exe
Resource
win7-en-20211208
General
-
Target
0b032e83c3a78f61fa3bf9cebd5a0242.exe
-
Size
4.5MB
-
MD5
0b032e83c3a78f61fa3bf9cebd5a0242
-
SHA1
f39705cde333b8c104f0a0381aa85de5a9d40e23
-
SHA256
4dbfb66b1aca617e4af7d11dcc9d97b11e61e94b188283a8f17f9078df30dbec
-
SHA512
776674d9a1e9ec68dd4f2a3d4deaf7eec921b3a306874f15956a70491bf6bb166d7994039dc724afcc1e1ed9150a91116965a79e8a320e37dced402d258e5a77
Malware Config
Extracted
bitrat
1.38
queentaline.ddns.net:1117
-
communication_password
202cb962ac59075b964b07152d234b70
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
0b032e83c3a78f61fa3bf9cebd5a0242.exepid process 3892 0b032e83c3a78f61fa3bf9cebd5a0242.exe 3892 0b032e83c3a78f61fa3bf9cebd5a0242.exe 3892 0b032e83c3a78f61fa3bf9cebd5a0242.exe 3892 0b032e83c3a78f61fa3bf9cebd5a0242.exe 3892 0b032e83c3a78f61fa3bf9cebd5a0242.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0b032e83c3a78f61fa3bf9cebd5a0242.exedescription pid process target process PID 2744 set thread context of 3892 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 0b032e83c3a78f61fa3bf9cebd5a0242.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1568 timeout.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
0b032e83c3a78f61fa3bf9cebd5a0242.exepowershell.exepid process 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 4068 powershell.exe 4068 powershell.exe 4068 powershell.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
0b032e83c3a78f61fa3bf9cebd5a0242.exepid process 3892 0b032e83c3a78f61fa3bf9cebd5a0242.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
0b032e83c3a78f61fa3bf9cebd5a0242.exepowershell.exe0b032e83c3a78f61fa3bf9cebd5a0242.exedescription pid process Token: SeDebugPrivilege 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe Token: SeDebugPrivilege 4068 powershell.exe Token: SeShutdownPrivilege 3892 0b032e83c3a78f61fa3bf9cebd5a0242.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0b032e83c3a78f61fa3bf9cebd5a0242.exepid process 3892 0b032e83c3a78f61fa3bf9cebd5a0242.exe 3892 0b032e83c3a78f61fa3bf9cebd5a0242.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
0b032e83c3a78f61fa3bf9cebd5a0242.exe0b032e83c3a78f61fa3bf9cebd5a0242.execmd.exedescription pid process target process PID 2744 wrote to memory of 4068 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe powershell.exe PID 2744 wrote to memory of 4068 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe powershell.exe PID 2744 wrote to memory of 4068 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe powershell.exe PID 2744 wrote to memory of 592 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe schtasks.exe PID 2744 wrote to memory of 592 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe schtasks.exe PID 2744 wrote to memory of 592 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe schtasks.exe PID 2744 wrote to memory of 3892 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 0b032e83c3a78f61fa3bf9cebd5a0242.exe PID 2744 wrote to memory of 3892 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 0b032e83c3a78f61fa3bf9cebd5a0242.exe PID 2744 wrote to memory of 3892 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 0b032e83c3a78f61fa3bf9cebd5a0242.exe PID 2744 wrote to memory of 3892 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 0b032e83c3a78f61fa3bf9cebd5a0242.exe PID 2744 wrote to memory of 3892 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 0b032e83c3a78f61fa3bf9cebd5a0242.exe PID 2744 wrote to memory of 3892 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 0b032e83c3a78f61fa3bf9cebd5a0242.exe PID 2744 wrote to memory of 3892 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 0b032e83c3a78f61fa3bf9cebd5a0242.exe PID 2744 wrote to memory of 3892 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 0b032e83c3a78f61fa3bf9cebd5a0242.exe PID 2744 wrote to memory of 3892 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 0b032e83c3a78f61fa3bf9cebd5a0242.exe PID 2744 wrote to memory of 3892 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 0b032e83c3a78f61fa3bf9cebd5a0242.exe PID 2744 wrote to memory of 3892 2744 0b032e83c3a78f61fa3bf9cebd5a0242.exe 0b032e83c3a78f61fa3bf9cebd5a0242.exe PID 3892 wrote to memory of 2452 3892 0b032e83c3a78f61fa3bf9cebd5a0242.exe cmd.exe PID 3892 wrote to memory of 2452 3892 0b032e83c3a78f61fa3bf9cebd5a0242.exe cmd.exe PID 2452 wrote to memory of 1568 2452 cmd.exe timeout.exe PID 2452 wrote to memory of 1568 2452 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b032e83c3a78f61fa3bf9cebd5a0242.exe"C:\Users\Admin\AppData\Local\Temp\0b032e83c3a78f61fa3bf9cebd5a0242.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tXqdqvrsfx.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tXqdqvrsfx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp531D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\0b032e83c3a78f61fa3bf9cebd5a0242.exe"C:\Users\Admin\AppData\Local\Temp\0b032e83c3a78f61fa3bf9cebd5a0242.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LJdJYr4v.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak4⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\LJdJYr4v.batMD5
51e82c978acb34864eb30cf26921be9f
SHA1031a874cc3da73c72d94c788b798c25bd2ec6ded
SHA256cdf1367a68b9d4c9ea8284ee39166cc3e7fa00976cb554788fb7671fc9fcfc1a
SHA512b0e91287eec4ff5b101c3bed061a0586db1b404b82ad8b7db6e7ac9b52b19aabe734a11173d44d65bfbe1fb987720bf19e3ba63cb8211cd09309274973c5ef1c
-
C:\Users\Admin\AppData\Local\Temp\tmp531D.tmpMD5
2f0fb983b8f980e5ff0abc03369227f6
SHA19bf20f62456cdf8f40a2038ec7f0dfae2ce7d29a
SHA2563c6399b73106dea6208232a90fa71f145cfe92f418a0765858c54de6d00e9310
SHA5128d11fe825a1e988dfe4b2684adecca8f9168605179e20b63453d1906cf8b4bf80e752e813d507459f0d123677ecc5071e12bb72daf5a0d9ee5c81973c08375d3
-
memory/592-124-0x0000000000000000-mapping.dmp
-
memory/1568-382-0x0000000000000000-mapping.dmp
-
memory/2452-380-0x0000000000000000-mapping.dmp
-
memory/2744-118-0x0000000004CD0000-0x0000000004CDA000-memory.dmpFilesize
40KB
-
memory/2744-120-0x0000000006730000-0x0000000006740000-memory.dmpFilesize
64KB
-
memory/2744-121-0x0000000007120000-0x00000000071BC000-memory.dmpFilesize
624KB
-
memory/2744-122-0x0000000008E20000-0x000000000934C000-memory.dmpFilesize
5.2MB
-
memory/2744-119-0x0000000004CB0000-0x00000000051AE000-memory.dmpFilesize
5.0MB
-
memory/2744-117-0x0000000004D50000-0x0000000004DE2000-memory.dmpFilesize
584KB
-
memory/2744-116-0x00000000051B0000-0x00000000056AE000-memory.dmpFilesize
5.0MB
-
memory/2744-115-0x0000000000010000-0x000000000049E000-memory.dmpFilesize
4.6MB
-
memory/2744-114-0x0000000000010000-0x000000000049E000-memory.dmpFilesize
4.6MB
-
memory/3892-131-0x000000000068A488-mapping.dmp
-
memory/3892-138-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/3892-130-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4068-136-0x0000000006592000-0x0000000006593000-memory.dmpFilesize
4KB
-
memory/4068-153-0x0000000006900000-0x0000000006922000-memory.dmpFilesize
136KB
-
memory/4068-133-0x0000000006AA0000-0x0000000006B06000-memory.dmpFilesize
408KB
-
memory/4068-134-0x0000000006B10000-0x0000000006B76000-memory.dmpFilesize
408KB
-
memory/4068-135-0x0000000006590000-0x0000000006591000-memory.dmpFilesize
4KB
-
memory/4068-137-0x0000000007530000-0x0000000007880000-memory.dmpFilesize
3.3MB
-
memory/4068-129-0x0000000006BD0000-0x00000000071F8000-memory.dmpFilesize
6.2MB
-
memory/4068-128-0x0000000006540000-0x0000000006576000-memory.dmpFilesize
216KB
-
memory/4068-139-0x0000000006A40000-0x0000000006A5C000-memory.dmpFilesize
112KB
-
memory/4068-140-0x0000000007BA0000-0x0000000007BEB000-memory.dmpFilesize
300KB
-
memory/4068-141-0x0000000007C70000-0x0000000007CE6000-memory.dmpFilesize
472KB
-
memory/4068-142-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/4068-150-0x0000000006BD0000-0x00000000071F8000-memory.dmpFilesize
6.2MB
-
memory/4068-152-0x0000000008C60000-0x0000000008C93000-memory.dmpFilesize
204KB
-
memory/4068-151-0x0000000008C60000-0x0000000008C93000-memory.dmpFilesize
204KB
-
memory/4068-132-0x0000000006900000-0x0000000006922000-memory.dmpFilesize
136KB
-
memory/4068-154-0x0000000006AA0000-0x0000000006B06000-memory.dmpFilesize
408KB
-
memory/4068-156-0x0000000007BA0000-0x0000000007BEB000-memory.dmpFilesize
300KB
-
memory/4068-155-0x0000000006B10000-0x0000000006B76000-memory.dmpFilesize
408KB
-
memory/4068-157-0x0000000007C70000-0x0000000007CE6000-memory.dmpFilesize
472KB
-
memory/4068-158-0x0000000008C20000-0x0000000008C3E000-memory.dmpFilesize
120KB
-
memory/4068-164-0x000000007E7C0000-0x000000007E7C1000-memory.dmpFilesize
4KB
-
memory/4068-163-0x0000000008D90000-0x0000000008E35000-memory.dmpFilesize
660KB
-
memory/4068-165-0x0000000008F50000-0x0000000008FE4000-memory.dmpFilesize
592KB
-
memory/4068-234-0x0000000006593000-0x0000000006594000-memory.dmpFilesize
4KB
-
memory/4068-359-0x0000000008EE0000-0x0000000008EFA000-memory.dmpFilesize
104KB
-
memory/4068-364-0x0000000008EE0000-0x0000000008EFA000-memory.dmpFilesize
104KB
-
memory/4068-365-0x0000000008ED0000-0x0000000008ED8000-memory.dmpFilesize
32KB
-
memory/4068-370-0x0000000008ED0000-0x0000000008ED8000-memory.dmpFilesize
32KB
-
memory/4068-126-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/4068-125-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/4068-123-0x0000000000000000-mapping.dmp