Analysis
-
max time kernel
168s -
max time network
234s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
10/05/2022, 18:47
Static task
static1
Behavioral task
behavioral1
Sample
BGA07HSJYEUW.exe
Resource
win7-20220414-en
General
-
Target
BGA07HSJYEUW.exe
-
Size
300.0MB
-
MD5
417e5e454f625ec291102dcb0edaadfd
-
SHA1
34c7f664c21dcc78c49b10d668773a8dbe314054
-
SHA256
99f6adbb8a1e75b3c0d9dc7f9e7b1e48576e0621f234dcae2691fbf7636dd039
-
SHA512
dd3da693c7f2a3629f382b2bdd9ee23bc5512bdd8ee34bffed14bb5442f755798c787eeb04b5010e059582f913cf591de4e435f717adda7f04db725d1edabb07
Malware Config
Extracted
bitrat
1.38
bitm01071.duckdns.org:5021
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Executes dropped EXE 1 IoCs
pid Process 1960 rtez.exe -
resource yara_rule behavioral1/memory/1172-60-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1172-62-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1172-63-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1172-66-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1172-65-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1172-67-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1172-69-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1616-88-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 1172 vbc.exe 1172 vbc.exe 1172 vbc.exe 1172 vbc.exe 1172 vbc.exe 1616 vbc.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 944 set thread context of 1172 944 BGA07HSJYEUW.exe 33 PID 1960 set thread context of 1616 1960 rtez.exe 41 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 948 schtasks.exe 1012 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 944 BGA07HSJYEUW.exe Token: 33 944 BGA07HSJYEUW.exe Token: SeIncBasePriorityPrivilege 944 BGA07HSJYEUW.exe Token: SeDebugPrivilege 1172 vbc.exe Token: SeShutdownPrivilege 1172 vbc.exe Token: SeDebugPrivilege 1960 rtez.exe Token: 33 1960 rtez.exe Token: SeIncBasePriorityPrivilege 1960 rtez.exe Token: SeDebugPrivilege 1616 vbc.exe Token: SeShutdownPrivilege 1616 vbc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1172 vbc.exe 1172 vbc.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 944 wrote to memory of 1888 944 BGA07HSJYEUW.exe 28 PID 944 wrote to memory of 1888 944 BGA07HSJYEUW.exe 28 PID 944 wrote to memory of 1888 944 BGA07HSJYEUW.exe 28 PID 944 wrote to memory of 1888 944 BGA07HSJYEUW.exe 28 PID 944 wrote to memory of 896 944 BGA07HSJYEUW.exe 30 PID 944 wrote to memory of 896 944 BGA07HSJYEUW.exe 30 PID 944 wrote to memory of 896 944 BGA07HSJYEUW.exe 30 PID 944 wrote to memory of 896 944 BGA07HSJYEUW.exe 30 PID 1888 wrote to memory of 948 1888 cmd.exe 32 PID 1888 wrote to memory of 948 1888 cmd.exe 32 PID 1888 wrote to memory of 948 1888 cmd.exe 32 PID 1888 wrote to memory of 948 1888 cmd.exe 32 PID 944 wrote to memory of 1172 944 BGA07HSJYEUW.exe 33 PID 944 wrote to memory of 1172 944 BGA07HSJYEUW.exe 33 PID 944 wrote to memory of 1172 944 BGA07HSJYEUW.exe 33 PID 944 wrote to memory of 1172 944 BGA07HSJYEUW.exe 33 PID 944 wrote to memory of 1172 944 BGA07HSJYEUW.exe 33 PID 944 wrote to memory of 1172 944 BGA07HSJYEUW.exe 33 PID 944 wrote to memory of 1172 944 BGA07HSJYEUW.exe 33 PID 944 wrote to memory of 1172 944 BGA07HSJYEUW.exe 33 PID 1160 wrote to memory of 1960 1160 taskeng.exe 35 PID 1160 wrote to memory of 1960 1160 taskeng.exe 35 PID 1160 wrote to memory of 1960 1160 taskeng.exe 35 PID 1160 wrote to memory of 1960 1160 taskeng.exe 35 PID 1960 wrote to memory of 1748 1960 rtez.exe 36 PID 1960 wrote to memory of 1748 1960 rtez.exe 36 PID 1960 wrote to memory of 1748 1960 rtez.exe 36 PID 1960 wrote to memory of 1748 1960 rtez.exe 36 PID 1960 wrote to memory of 832 1960 rtez.exe 38 PID 1960 wrote to memory of 832 1960 rtez.exe 38 PID 1960 wrote to memory of 832 1960 rtez.exe 38 PID 1960 wrote to memory of 832 1960 rtez.exe 38 PID 1748 wrote to memory of 1012 1748 cmd.exe 40 PID 1748 wrote to memory of 1012 1748 cmd.exe 40 PID 1748 wrote to memory of 1012 1748 cmd.exe 40 PID 1748 wrote to memory of 1012 1748 cmd.exe 40 PID 1960 wrote to memory of 1616 1960 rtez.exe 41 PID 1960 wrote to memory of 1616 1960 rtez.exe 41 PID 1960 wrote to memory of 1616 1960 rtez.exe 41 PID 1960 wrote to memory of 1616 1960 rtez.exe 41 PID 1960 wrote to memory of 1616 1960 rtez.exe 41 PID 1960 wrote to memory of 1616 1960 rtez.exe 41 PID 1960 wrote to memory of 1616 1960 rtez.exe 41 PID 1960 wrote to memory of 1616 1960 rtez.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\BGA07HSJYEUW.exe"C:\Users\Admin\AppData\Local\Temp\BGA07HSJYEUW.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\rtez.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\rtez.exe'" /f3⤵
- Creates scheduled task(s)
PID:948
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\BGA07HSJYEUW.exe" "C:\Users\Admin\AppData\Roaming\rtez.exe"2⤵PID:896
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1172
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {CDE5789C-4157-47FA-A1D0-67620DCCAF19} S-1-5-21-2277218442-1199762539-2004043321-1000:AUVQQRRF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Roaming\rtez.exeC:\Users\Admin\AppData\Roaming\rtez.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\rtez.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\rtez.exe'" /f4⤵
- Creates scheduled task(s)
PID:1012
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\rtez.exe" "C:\Users\Admin\AppData\Roaming\rtez.exe"3⤵PID:832
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
300.0MB
MD5417e5e454f625ec291102dcb0edaadfd
SHA134c7f664c21dcc78c49b10d668773a8dbe314054
SHA25699f6adbb8a1e75b3c0d9dc7f9e7b1e48576e0621f234dcae2691fbf7636dd039
SHA512dd3da693c7f2a3629f382b2bdd9ee23bc5512bdd8ee34bffed14bb5442f755798c787eeb04b5010e059582f913cf591de4e435f717adda7f04db725d1edabb07
-
Filesize
300.0MB
MD5417e5e454f625ec291102dcb0edaadfd
SHA134c7f664c21dcc78c49b10d668773a8dbe314054
SHA25699f6adbb8a1e75b3c0d9dc7f9e7b1e48576e0621f234dcae2691fbf7636dd039
SHA512dd3da693c7f2a3629f382b2bdd9ee23bc5512bdd8ee34bffed14bb5442f755798c787eeb04b5010e059582f913cf591de4e435f717adda7f04db725d1edabb07