Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 23:15
Static task
static1
Behavioral task
behavioral1
Sample
b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe
Resource
win10-en-20211208
General
-
Target
b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe
-
Size
2.2MB
-
MD5
d97470fad1b553c3f0266a8a84e6fdc2
-
SHA1
d0612e51c71e54a9c03e8403877840997a604672
-
SHA256
b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e
-
SHA512
4da2d313010e502abb98058b23e7bfdd561c855c482065d75eadbdd49e16ea8792d4b7aa083a47e2ad5202bdb5b0a8b3ed95632cd3b8a3c60b3787bbbcaf05ad
Malware Config
Extracted
bitrat
1.35
publiquilla.linkpc.net:9090
-
communication_password
bfdba24ee3d61f0260c4dc1034c3ee43
-
install_dir
windowssecurirysercivehealth
-
install_file
windowssecurirysercive.exe
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral2/memory/608-125-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/608-126-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/608-127-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\windowssecurirysercive = "C:\\Users\\Admin\\AppData\\Local\\windowssecurirysercivehealth\\windowssecurirysercive.exe" b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\windowssecurirysercive = "C:\\Users\\Admin\\AppData\\Local\\windowssecurirysercivehealth\\windowssecurirysercive.exe挀" b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\windowssecurirysercive = "C:\\Users\\Admin\\AppData\\Local\\windowssecurirysercivehealth\\windowssecurirysercive.exe猀" b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\windowssecurirysercive = "C:\\Users\\Admin\\AppData\\Local\\windowssecurirysercivehealth\\windowssecurirysercive.exe\u2000" b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\windowssecurirysercive = "C:\\Users\\Admin\\AppData\\Local\\windowssecurirysercivehealth\\windowssecurirysercive.exe저" b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exepid process 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exedescription pid process target process PID 2352 set thread context of 608 2352 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exepid process 2352 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe 2352 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe -
Suspicious behavior: RenamesItself 9 IoCs
Processes:
b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exepid process 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exeb8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exedescription pid process Token: SeDebugPrivilege 2352 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe Token: SeShutdownPrivilege 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exepid process 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe 608 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exedescription pid process target process PID 2352 wrote to memory of 1172 2352 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe PID 2352 wrote to memory of 1172 2352 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe PID 2352 wrote to memory of 1172 2352 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe PID 2352 wrote to memory of 608 2352 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe PID 2352 wrote to memory of 608 2352 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe PID 2352 wrote to memory of 608 2352 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe PID 2352 wrote to memory of 608 2352 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe PID 2352 wrote to memory of 608 2352 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe PID 2352 wrote to memory of 608 2352 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe PID 2352 wrote to memory of 608 2352 b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe"C:\Users\Admin\AppData\Local\Temp\b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe"C:\Users\Admin\AppData\Local\Temp\b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe"C:\Users\Admin\AppData\Local\Temp\b8d1bac077990b3996eec50536cffceb32c25943fb0402ef358fc0eeb3083b5e.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/608-125-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/608-127-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/608-126-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2352-121-0x0000000004E40000-0x000000000533E000-memory.dmpFilesize
5.0MB
-
memory/2352-119-0x0000000002860000-0x000000000286A000-memory.dmpFilesize
40KB
-
memory/2352-120-0x0000000004F60000-0x0000000004FB6000-memory.dmpFilesize
344KB
-
memory/2352-115-0x0000000000260000-0x00000000004A6000-memory.dmpFilesize
2.3MB
-
memory/2352-122-0x0000000005130000-0x0000000005152000-memory.dmpFilesize
136KB
-
memory/2352-123-0x0000000006F30000-0x0000000007104000-memory.dmpFilesize
1.8MB
-
memory/2352-124-0x000000000A5B0000-0x000000000A732000-memory.dmpFilesize
1.5MB
-
memory/2352-118-0x0000000004E40000-0x0000000004ED2000-memory.dmpFilesize
584KB
-
memory/2352-117-0x0000000005340000-0x000000000583E000-memory.dmpFilesize
5.0MB
-
memory/2352-116-0x0000000004CD0000-0x0000000004D6C000-memory.dmpFilesize
624KB