Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
05-01-2022 12:25
Static task
static1
Behavioral task
behavioral1
Sample
2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe
Resource
win10-en-20211208
General
-
Target
2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe
-
Size
4.2MB
-
MD5
99e35efb08a65b2cd59aa0cc8e27a64d
-
SHA1
c24cd0527cbef8c76fbe386ce81cc844cc5acb36
-
SHA256
2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912
-
SHA512
029ef3b887f3683142ba18c5c72cfcd17931f63bc4397f5942370427b4a4c7fc1ee22789254da525c57dfc4a6d1818f12cc65cc3a4bec79fd2efffb17bc106f2
Malware Config
Extracted
bitrat
1.38
91.243.32.131:80
-
communication_password
202cb962ac59075b964b07152d234b70
-
install_dir
Defenderzone
-
install_file
syspro.exe
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\syspro = "C:\\Users\\Admin\\AppData\\Local\\Defenderzone\\syspro.exe" 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\syspro = "C:\\Users\\Admin\\AppData\\Local\\Defenderzone\\syspro.exe\u0600" 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\syspro = "C:\\Users\\Admin\\AppData\\Local\\Defenderzone\\syspro.exe\uff00" 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exepid process 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exepid process 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe -
Suspicious behavior: RenamesItself 29 IoCs
Processes:
2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exepid process 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exedescription pid process Token: SeShutdownPrivilege 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exepid process 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe 4108 2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe"C:\Users\Admin\AppData\Local\Temp\2b82105ff0273e98abbfa2708e7b25dcb5eebab0344a3de1fd9bcfd841281912.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4108-115-0x0000000000400000-0x0000000000807000-memory.dmpFilesize
4.0MB
-
memory/4108-116-0x0000000000400000-0x0000000000807000-memory.dmpFilesize
4.0MB
-
memory/4108-117-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4108-118-0x0000000000400000-0x0000000000807000-memory.dmpFilesize
4.0MB
-
memory/4108-119-0x0000000000400000-0x0000000000807000-memory.dmpFilesize
4.0MB
-
memory/4108-120-0x0000000000401000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/4108-121-0x00000000761D0000-0x0000000076392000-memory.dmpFilesize
1.8MB
-
memory/4108-122-0x0000000000401000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/4108-123-0x0000000002430000-0x0000000002476000-memory.dmpFilesize
280KB
-
memory/4108-124-0x0000000000401000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/4108-125-0x0000000076570000-0x0000000076661000-memory.dmpFilesize
964KB