Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
13-01-2022 18:00
Static task
static1
Behavioral task
behavioral1
Sample
780fd4b0a5fde771e1997ce53896cb9f.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
780fd4b0a5fde771e1997ce53896cb9f.exe
Resource
win10-en-20211208
General
-
Target
780fd4b0a5fde771e1997ce53896cb9f.exe
-
Size
115KB
-
MD5
780fd4b0a5fde771e1997ce53896cb9f
-
SHA1
620c2e4b60d2f902933ff6a20042f71b53833e10
-
SHA256
a6d0e2abcc93742839c48666cfee33a4647b42863c7a3304691eed1fc5e854fb
-
SHA512
f5b3434abe7fbe02be993904b572c08b7c7e5963f8fec8fc4dfbc027c76bd21a9c7188b4a5fdda269d77c36c7fee37465251b490f09fe6fc303577bb6cae0f4d
Malware Config
Extracted
bitrat
1.38
drfcjug.duckdns.org:1882
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral1/memory/560-62-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/560-61-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/560-63-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/560-65-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/560-67-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
780fd4b0a5fde771e1997ce53896cb9f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Local\\chrome.exe\"" 780fd4b0a5fde771e1997ce53896cb9f.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
InstallUtil.exepid process 560 InstallUtil.exe 560 InstallUtil.exe 560 InstallUtil.exe 560 InstallUtil.exe 560 InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
780fd4b0a5fde771e1997ce53896cb9f.exedescription pid process target process PID 1748 set thread context of 560 1748 780fd4b0a5fde771e1997ce53896cb9f.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
780fd4b0a5fde771e1997ce53896cb9f.exepid process 1748 780fd4b0a5fde771e1997ce53896cb9f.exe 1748 780fd4b0a5fde771e1997ce53896cb9f.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
780fd4b0a5fde771e1997ce53896cb9f.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1748 780fd4b0a5fde771e1997ce53896cb9f.exe Token: SeDebugPrivilege 560 InstallUtil.exe Token: SeShutdownPrivilege 560 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
InstallUtil.exepid process 560 InstallUtil.exe 560 InstallUtil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
780fd4b0a5fde771e1997ce53896cb9f.exedescription pid process target process PID 1748 wrote to memory of 560 1748 780fd4b0a5fde771e1997ce53896cb9f.exe InstallUtil.exe PID 1748 wrote to memory of 560 1748 780fd4b0a5fde771e1997ce53896cb9f.exe InstallUtil.exe PID 1748 wrote to memory of 560 1748 780fd4b0a5fde771e1997ce53896cb9f.exe InstallUtil.exe PID 1748 wrote to memory of 560 1748 780fd4b0a5fde771e1997ce53896cb9f.exe InstallUtil.exe PID 1748 wrote to memory of 560 1748 780fd4b0a5fde771e1997ce53896cb9f.exe InstallUtil.exe PID 1748 wrote to memory of 560 1748 780fd4b0a5fde771e1997ce53896cb9f.exe InstallUtil.exe PID 1748 wrote to memory of 560 1748 780fd4b0a5fde771e1997ce53896cb9f.exe InstallUtil.exe PID 1748 wrote to memory of 560 1748 780fd4b0a5fde771e1997ce53896cb9f.exe InstallUtil.exe PID 1748 wrote to memory of 560 1748 780fd4b0a5fde771e1997ce53896cb9f.exe InstallUtil.exe PID 1748 wrote to memory of 560 1748 780fd4b0a5fde771e1997ce53896cb9f.exe InstallUtil.exe PID 1748 wrote to memory of 560 1748 780fd4b0a5fde771e1997ce53896cb9f.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\780fd4b0a5fde771e1997ce53896cb9f.exe"C:\Users\Admin\AppData\Local\Temp\780fd4b0a5fde771e1997ce53896cb9f.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/560-63-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/560-60-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/560-62-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/560-61-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/560-64-0x00000000007E2720-mapping.dmp
-
memory/560-65-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/560-67-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1748-55-0x0000000000ED0000-0x0000000000EF2000-memory.dmpFilesize
136KB
-
memory/1748-56-0x0000000075761000-0x0000000075763000-memory.dmpFilesize
8KB
-
memory/1748-57-0x0000000000CF0000-0x0000000000CF1000-memory.dmpFilesize
4KB
-
memory/1748-58-0x0000000005CC0000-0x0000000005E98000-memory.dmpFilesize
1.8MB
-
memory/1748-59-0x0000000004EA0000-0x0000000004EEC000-memory.dmpFilesize
304KB
-
memory/1748-54-0x0000000000ED0000-0x0000000000EF2000-memory.dmpFilesize
136KB