Analysis
-
max time kernel
169s -
max time network
201s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08/05/2022, 06:35
Static task
static1
Behavioral task
behavioral1
Sample
3ac92596215d32932cf4e2c59cfed2665d23a5a5acd5c7355da04271132203ca.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3ac92596215d32932cf4e2c59cfed2665d23a5a5acd5c7355da04271132203ca.exe
Resource
win10v2004-20220414-en
General
-
Target
3ac92596215d32932cf4e2c59cfed2665d23a5a5acd5c7355da04271132203ca.exe
-
Size
2.1MB
-
MD5
b2feac6aa6a89365b3f010a0cd34147d
-
SHA1
2faf499f54dbeb1dd46ab018b9f31b566711c432
-
SHA256
3ac92596215d32932cf4e2c59cfed2665d23a5a5acd5c7355da04271132203ca
-
SHA512
d96bf8aebfc1467d0380f41652e98a56b39f8252843b29024b69d7ad44121ab876fea5d752a49b9b6f5cf24e2d791ececdc7d50092e7f2d7ab1586fd97742349
Malware Config
Signatures
-
BitRAT Payload 2 IoCs
resource yara_rule behavioral1/memory/1156-91-0x0000000000400000-0x0000000000807000-memory.dmp family_bitrat behavioral1/memory/1156-92-0x0000000000400000-0x0000000000807000-memory.dmp family_bitrat -
Executes dropped EXE 2 IoCs
pid Process 2032 Cavqm.exe 1540 Cavqm.exe -
resource yara_rule behavioral1/memory/1156-81-0x0000000000400000-0x0000000000807000-memory.dmp upx behavioral1/memory/1156-83-0x0000000000400000-0x0000000000807000-memory.dmp upx behavioral1/memory/1156-84-0x0000000000400000-0x0000000000807000-memory.dmp upx behavioral1/memory/1156-87-0x0000000000400000-0x0000000000807000-memory.dmp upx behavioral1/memory/1156-86-0x0000000000400000-0x0000000000807000-memory.dmp upx behavioral1/memory/1156-90-0x0000000000400000-0x0000000000807000-memory.dmp upx behavioral1/memory/1156-91-0x0000000000400000-0x0000000000807000-memory.dmp upx behavioral1/memory/1156-92-0x0000000000400000-0x0000000000807000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 1004 3ac92596215d32932cf4e2c59cfed2665d23a5a5acd5c7355da04271132203ca.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ojtkmq = "C:\\Users\\Admin\\AppData\\Roaming\\Fehulu\\Ojtkmq.url" Cavqm.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 myexternalip.com 5 myexternalip.com 12 myexternalip.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 1156 regasm.exe 1156 regasm.exe 1156 regasm.exe 1156 regasm.exe 1156 regasm.exe 1156 regasm.exe 1156 regasm.exe 1156 regasm.exe 1156 regasm.exe 1156 regasm.exe 1156 regasm.exe 1156 regasm.exe 1156 regasm.exe 1156 regasm.exe 1156 regasm.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2032 set thread context of 1920 2032 Cavqm.exe 29 PID 2032 set thread context of 1156 2032 Cavqm.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2032 Cavqm.exe 2032 Cavqm.exe 1920 regasm.exe 1920 regasm.exe 2032 Cavqm.exe 2032 Cavqm.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2032 Cavqm.exe Token: SeDebugPrivilege 1920 regasm.exe Token: SeDebugPrivilege 1156 regasm.exe Token: SeShutdownPrivilege 1156 regasm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1156 regasm.exe 1156 regasm.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 1004 wrote to memory of 2032 1004 3ac92596215d32932cf4e2c59cfed2665d23a5a5acd5c7355da04271132203ca.exe 28 PID 1004 wrote to memory of 2032 1004 3ac92596215d32932cf4e2c59cfed2665d23a5a5acd5c7355da04271132203ca.exe 28 PID 1004 wrote to memory of 2032 1004 3ac92596215d32932cf4e2c59cfed2665d23a5a5acd5c7355da04271132203ca.exe 28 PID 1004 wrote to memory of 2032 1004 3ac92596215d32932cf4e2c59cfed2665d23a5a5acd5c7355da04271132203ca.exe 28 PID 2032 wrote to memory of 1920 2032 Cavqm.exe 29 PID 2032 wrote to memory of 1920 2032 Cavqm.exe 29 PID 2032 wrote to memory of 1920 2032 Cavqm.exe 29 PID 2032 wrote to memory of 1920 2032 Cavqm.exe 29 PID 2032 wrote to memory of 1920 2032 Cavqm.exe 29 PID 2032 wrote to memory of 1920 2032 Cavqm.exe 29 PID 2032 wrote to memory of 1920 2032 Cavqm.exe 29 PID 2032 wrote to memory of 1920 2032 Cavqm.exe 29 PID 2032 wrote to memory of 1920 2032 Cavqm.exe 29 PID 2032 wrote to memory of 1920 2032 Cavqm.exe 29 PID 2032 wrote to memory of 1920 2032 Cavqm.exe 29 PID 2032 wrote to memory of 1920 2032 Cavqm.exe 29 PID 2032 wrote to memory of 1540 2032 Cavqm.exe 30 PID 2032 wrote to memory of 1540 2032 Cavqm.exe 30 PID 2032 wrote to memory of 1540 2032 Cavqm.exe 30 PID 2032 wrote to memory of 1540 2032 Cavqm.exe 30 PID 2032 wrote to memory of 1156 2032 Cavqm.exe 31 PID 2032 wrote to memory of 1156 2032 Cavqm.exe 31 PID 2032 wrote to memory of 1156 2032 Cavqm.exe 31 PID 2032 wrote to memory of 1156 2032 Cavqm.exe 31 PID 2032 wrote to memory of 1156 2032 Cavqm.exe 31 PID 2032 wrote to memory of 1156 2032 Cavqm.exe 31 PID 2032 wrote to memory of 1156 2032 Cavqm.exe 31 PID 2032 wrote to memory of 1156 2032 Cavqm.exe 31 PID 2032 wrote to memory of 1156 2032 Cavqm.exe 31 PID 2032 wrote to memory of 1156 2032 Cavqm.exe 31 PID 2032 wrote to memory of 1156 2032 Cavqm.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ac92596215d32932cf4e2c59cfed2665d23a5a5acd5c7355da04271132203ca.exe"C:\Users\Admin\AppData\Local\Temp\3ac92596215d32932cf4e2c59cfed2665d23a5a5acd5c7355da04271132203ca.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Roaming\Fehulu\Cavqm.exe"C:\Users\Admin\AppData\Roaming\Fehulu\Cavqm.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
-
C:\Users\Admin\AppData\Roaming\Fehulu\Cavqm.exe"C:\Users\Admin\AppData\Roaming\Fehulu\Cavqm.exe"3⤵
- Executes dropped EXE
PID:1540
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1156
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5b2feac6aa6a89365b3f010a0cd34147d
SHA12faf499f54dbeb1dd46ab018b9f31b566711c432
SHA2563ac92596215d32932cf4e2c59cfed2665d23a5a5acd5c7355da04271132203ca
SHA512d96bf8aebfc1467d0380f41652e98a56b39f8252843b29024b69d7ad44121ab876fea5d752a49b9b6f5cf24e2d791ececdc7d50092e7f2d7ab1586fd97742349
-
Filesize
2.1MB
MD5b2feac6aa6a89365b3f010a0cd34147d
SHA12faf499f54dbeb1dd46ab018b9f31b566711c432
SHA2563ac92596215d32932cf4e2c59cfed2665d23a5a5acd5c7355da04271132203ca
SHA512d96bf8aebfc1467d0380f41652e98a56b39f8252843b29024b69d7ad44121ab876fea5d752a49b9b6f5cf24e2d791ececdc7d50092e7f2d7ab1586fd97742349
-
Filesize
2.1MB
MD5b2feac6aa6a89365b3f010a0cd34147d
SHA12faf499f54dbeb1dd46ab018b9f31b566711c432
SHA2563ac92596215d32932cf4e2c59cfed2665d23a5a5acd5c7355da04271132203ca
SHA512d96bf8aebfc1467d0380f41652e98a56b39f8252843b29024b69d7ad44121ab876fea5d752a49b9b6f5cf24e2d791ececdc7d50092e7f2d7ab1586fd97742349
-
Filesize
168B
MD51745f298ce618adb5c667e42b2e1b5c9
SHA166ab7e9f4dc3780fcc0b6d0ee31cb0259f2d2060
SHA2569bcd11157e69126e6b191cfaee6e51104b364347fe6a20dcb64bce8bc47a1b74
SHA51213bf2e06b196eb914c693ee28b9d7c03932026760f163248ca129f30178b1054d1bc6e99294e180d1b7ae1656f062a5ebaca6ef10ce8f189d8afb8dc67df094c
-
Filesize
2.1MB
MD5b2feac6aa6a89365b3f010a0cd34147d
SHA12faf499f54dbeb1dd46ab018b9f31b566711c432
SHA2563ac92596215d32932cf4e2c59cfed2665d23a5a5acd5c7355da04271132203ca
SHA512d96bf8aebfc1467d0380f41652e98a56b39f8252843b29024b69d7ad44121ab876fea5d752a49b9b6f5cf24e2d791ececdc7d50092e7f2d7ab1586fd97742349