Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
17-01-2022 20:23
Static task
static1
Behavioral task
behavioral1
Sample
badbadnotgood.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
badbadnotgood.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
badbadnotgood.exe
-
Size
112KB
-
MD5
cc53642dc142809c56f656d8ee702650
-
SHA1
a18dcff5ec9ff5027309790d8bc0dd660cae38b8
-
SHA256
512ce7a1f66a65d818533dc79f2eb3dbb31696961e45f34e3a2ce98080488dc3
-
SHA512
31deb2edede5999afa926041700ecec71c734c5d76b88f548bd702dc66fc0fe7e7b0cf2578f80a7196d027577cb9850240af593af669c815ed43b9de3e7a6f2f
Score
10/10
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
drfcjug.duckdns.org:1882
Attributes
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1828-61-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1828-62-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1828-63-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1828-65-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1828-67-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
badbadnotgood.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Local\\chrome.exe\"" badbadnotgood.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
InstallUtil.exepid process 1828 InstallUtil.exe 1828 InstallUtil.exe 1828 InstallUtil.exe 1828 InstallUtil.exe 1828 InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
badbadnotgood.exedescription pid process target process PID 1592 set thread context of 1828 1592 badbadnotgood.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
badbadnotgood.exepid process 1592 badbadnotgood.exe 1592 badbadnotgood.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
badbadnotgood.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1592 badbadnotgood.exe Token: SeDebugPrivilege 1828 InstallUtil.exe Token: SeShutdownPrivilege 1828 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
InstallUtil.exepid process 1828 InstallUtil.exe 1828 InstallUtil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
badbadnotgood.exedescription pid process target process PID 1592 wrote to memory of 1828 1592 badbadnotgood.exe InstallUtil.exe PID 1592 wrote to memory of 1828 1592 badbadnotgood.exe InstallUtil.exe PID 1592 wrote to memory of 1828 1592 badbadnotgood.exe InstallUtil.exe PID 1592 wrote to memory of 1828 1592 badbadnotgood.exe InstallUtil.exe PID 1592 wrote to memory of 1828 1592 badbadnotgood.exe InstallUtil.exe PID 1592 wrote to memory of 1828 1592 badbadnotgood.exe InstallUtil.exe PID 1592 wrote to memory of 1828 1592 badbadnotgood.exe InstallUtil.exe PID 1592 wrote to memory of 1828 1592 badbadnotgood.exe InstallUtil.exe PID 1592 wrote to memory of 1828 1592 badbadnotgood.exe InstallUtil.exe PID 1592 wrote to memory of 1828 1592 badbadnotgood.exe InstallUtil.exe PID 1592 wrote to memory of 1828 1592 badbadnotgood.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\badbadnotgood.exe"C:\Users\Admin\AppData\Local\Temp\badbadnotgood.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1592-54-0x0000000000B10000-0x0000000000B32000-memory.dmpFilesize
136KB
-
memory/1592-55-0x0000000000B10000-0x0000000000B32000-memory.dmpFilesize
136KB
-
memory/1592-56-0x0000000076151000-0x0000000076153000-memory.dmpFilesize
8KB
-
memory/1592-57-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB
-
memory/1592-58-0x0000000005E00000-0x0000000005FD8000-memory.dmpFilesize
1.8MB
-
memory/1592-59-0x0000000004730000-0x000000000477C000-memory.dmpFilesize
304KB
-
memory/1828-60-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1828-61-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1828-62-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1828-63-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1828-64-0x00000000007E2720-mapping.dmp
-
memory/1828-65-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1828-67-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB