Analysis
-
max time kernel
204s -
max time network
249s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08/05/2022, 06:12
Static task
static1
Behavioral task
behavioral1
Sample
ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe
Resource
win10v2004-20220414-en
General
-
Target
ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe
-
Size
951KB
-
MD5
78f3c0e0e1ebb93fde1ab54078e1a45f
-
SHA1
a2cd4f5901cfecc3f788993fe986404c37e34702
-
SHA256
ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8
-
SHA512
ac72c4d5df979fa215e23fae83403e6f035598be077d48f97382bbbd4b1823ed0050b7bdf970e59ae39993c048ef505943e1cf22507eea0266225cdc84e309df
Malware Config
Signatures
-
BitRAT Payload 2 IoCs
resource yara_rule behavioral2/memory/3144-149-0x0000000000400000-0x0000000000800000-memory.dmp family_bitrat behavioral2/memory/3144-150-0x0000000000400000-0x0000000000800000-memory.dmp family_bitrat -
resource yara_rule behavioral2/memory/3144-146-0x0000000000400000-0x0000000000800000-memory.dmp upx behavioral2/memory/3144-148-0x0000000000400000-0x0000000000800000-memory.dmp upx behavioral2/memory/3144-149-0x0000000000400000-0x0000000000800000-memory.dmp upx behavioral2/memory/3144-150-0x0000000000400000-0x0000000000800000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Obak = "C:\\Users\\Admin\\AppData\\Local\\kabO.url" ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3144 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2352 set thread context of 3144 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 92 -
Modifies registry key 1 TTPs 3 IoCs
pid Process 1028 reg.exe 2116 reg.exe 4240 reg.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 3144 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3144 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 3144 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82 PID 2352 wrote to memory of 3444 2352 ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe"C:\Users\Admin\AppData\Local\Temp\ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\Notepad.exe"C:\Windows\System32\Notepad.exe"2⤵PID:3444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat3⤵PID:1116
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:1028
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:2116
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:3952
-
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:4240
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat3⤵PID:4264
-
-
-
C:\Users\Admin\AppData\Local\Temp\ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe"C:\Users\Admin\AppData\Local\Temp\ed5d49b6a5348ec9c64d9fd3c5df4218a24e7c819de5716adc3de05702890ec8.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3144
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
283B
MD55cc1682955fd9f5800a8f1530c9a4334
SHA1e09b6a4d729f2f4760ee42520ec30c3192c85548
SHA2565562cc607d2f698327efacc4a21bd079bb14a99b03e7a01b3c67f8440e341cb3
SHA51280767263aad44c739236161d4338d5dd8b0b58613f22cd173c3e88ebf143220ee56bbf93ace69a07d3c2f00daff0adbaa8461a1d53d12699725395c931c43cb6