Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
06-01-2022 20:01
Static task
static1
Behavioral task
behavioral1
Sample
32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe
Resource
win10-en-20211208
General
-
Target
32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe
-
Size
2.2MB
-
MD5
4136661e8a9689aca8802518294b02fe
-
SHA1
3f43207a00cd456fd54e783e95b20a849c09961b
-
SHA256
32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788
-
SHA512
6d9290a19be178c2e561bb9209ee5bf7309a8d89922ebc3cc200756d6e85058aedce1a3df6c45149f2c677f61c98b8fee943d31807aece251799710ae42ec82e
Malware Config
Extracted
bitrat
1.38
91.243.32.131:80
-
communication_password
202cb962ac59075b964b07152d234b70
-
install_dir
Defenderzone
-
install_file
syspro.exe
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\syspro = "C:\\Users\\Admin\\AppData\\Local\\Defenderzone\\syspro.exe\u2000" 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\syspro = "C:\\Users\\Admin\\AppData\\Local\\Defenderzone\\syspro.exe脀" 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\syspro = "C:\\Users\\Admin\\AppData\\Local\\Defenderzone\\syspro.exe" 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\syspro = "C:\\Users\\Admin\\AppData\\Local\\Defenderzone\\syspro.exe鸀" 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\syspro = "C:\\Users\\Admin\\AppData\\Local\\Defenderzone\\syspro.exe縀" 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\syspro = "C:\\Users\\Admin\\AppData\\Local\\Defenderzone\\syspro.exe\uff00" 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\syspro = "C:\\Users\\Admin\\AppData\\Local\\Defenderzone\\syspro.exeĀ" 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\syspro = "C:\\Users\\Admin\\AppData\\Local\\Defenderzone\\syspro.exe䀀" 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exepid process 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exepid process 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe -
Suspicious behavior: RenamesItself 29 IoCs
Processes:
32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exepid process 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exedescription pid process Token: SeShutdownPrivilege 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exepid process 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe 748 32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe"C:\Users\Admin\AppData\Local\Temp\32ca272da062d0997c8131b5488af9858420cb97ab7d67fb911afc37d45e4788.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/748-115-0x00000000025C0000-0x0000000002606000-memory.dmpFilesize
280KB
-
memory/748-116-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/748-117-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/748-118-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/748-119-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/748-120-0x0000000000401000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/748-121-0x00000000759A0000-0x0000000075B62000-memory.dmpFilesize
1.8MB
-
memory/748-122-0x0000000000401000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/748-123-0x0000000000401000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/748-124-0x0000000074E00000-0x0000000074EF1000-memory.dmpFilesize
964KB
-
memory/748-125-0x00000000750B0000-0x0000000075634000-memory.dmpFilesize
5.5MB