Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
02-06-2022 15:00
Static task
static1
Behavioral task
behavioral1
Sample
21b9d51376efde8b0b9253c0b32e8bf5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
21b9d51376efde8b0b9253c0b32e8bf5.exe
Resource
win10v2004-20220414-en
General
-
Target
21b9d51376efde8b0b9253c0b32e8bf5.exe
-
Size
36KB
-
MD5
21b9d51376efde8b0b9253c0b32e8bf5
-
SHA1
c7bbca83797e5a71e071b2f1d3eda5147e99ffa2
-
SHA256
a5463d144af0f2c9e1725f7a6c520977986bad3c3e3c3feb344b08b98c795c73
-
SHA512
ea10342a206bb1cf8ef606e61a2b3b70404c78ce3beb272957e8d0c0bf762140799c4d79aca0255120703d8e47b6e90338d97f7a80c2c220127ff494074751b9
Malware Config
Extracted
bitrat
1.38
gfeqqgeag.duckdns.org:1880
-
communication_password
202cb962ac59075b964b07152d234b70
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Processes:
resource yara_rule behavioral1/memory/1772-92-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1772-94-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1772-95-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1772-97-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1772-98-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1772-102-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1772-107-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
21b9d51376efde8b0b9253c0b32e8bf5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\spotify = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ndvzfed\\spotify.exe\"" 21b9d51376efde8b0b9253c0b32e8bf5.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
InstallUtil.exepid process 1772 InstallUtil.exe 1772 InstallUtil.exe 1772 InstallUtil.exe 1772 InstallUtil.exe 1772 InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
21b9d51376efde8b0b9253c0b32e8bf5.exedescription pid process target process PID 1668 set thread context of 1772 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 524 timeout.exe -
Processes:
21b9d51376efde8b0b9253c0b32e8bf5.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 21b9d51376efde8b0b9253c0b32e8bf5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 21b9d51376efde8b0b9253c0b32e8bf5.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exe21b9d51376efde8b0b9253c0b32e8bf5.exepid process 1188 powershell.exe 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
21b9d51376efde8b0b9253c0b32e8bf5.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe Token: SeDebugPrivilege 1188 powershell.exe Token: SeDebugPrivilege 1772 InstallUtil.exe Token: SeShutdownPrivilege 1772 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
InstallUtil.exepid process 1772 InstallUtil.exe 1772 InstallUtil.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
21b9d51376efde8b0b9253c0b32e8bf5.execmd.exedescription pid process target process PID 1668 wrote to memory of 1188 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe powershell.exe PID 1668 wrote to memory of 1188 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe powershell.exe PID 1668 wrote to memory of 1188 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe powershell.exe PID 1668 wrote to memory of 1188 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe powershell.exe PID 1668 wrote to memory of 1932 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe cmd.exe PID 1668 wrote to memory of 1932 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe cmd.exe PID 1668 wrote to memory of 1932 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe cmd.exe PID 1668 wrote to memory of 1932 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe cmd.exe PID 1932 wrote to memory of 524 1932 cmd.exe timeout.exe PID 1932 wrote to memory of 524 1932 cmd.exe timeout.exe PID 1932 wrote to memory of 524 1932 cmd.exe timeout.exe PID 1932 wrote to memory of 524 1932 cmd.exe timeout.exe PID 1668 wrote to memory of 1772 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe InstallUtil.exe PID 1668 wrote to memory of 1772 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe InstallUtil.exe PID 1668 wrote to memory of 1772 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe InstallUtil.exe PID 1668 wrote to memory of 1772 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe InstallUtil.exe PID 1668 wrote to memory of 1772 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe InstallUtil.exe PID 1668 wrote to memory of 1772 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe InstallUtil.exe PID 1668 wrote to memory of 1772 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe InstallUtil.exe PID 1668 wrote to memory of 1772 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe InstallUtil.exe PID 1668 wrote to memory of 1772 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe InstallUtil.exe PID 1668 wrote to memory of 1772 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe InstallUtil.exe PID 1668 wrote to memory of 1772 1668 21b9d51376efde8b0b9253c0b32e8bf5.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21b9d51376efde8b0b9253c0b32e8bf5.exe"C:\Users\Admin\AppData\Local\Temp\21b9d51376efde8b0b9253c0b32e8bf5.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 202⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 203⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-90-0x0000000000000000-mapping.dmp
-
memory/1188-67-0x000000006EE70000-0x000000006F6EA000-memory.dmpFilesize
8.5MB
-
memory/1188-78-0x000000006E3B0000-0x000000006E8E6000-memory.dmpFilesize
5.2MB
-
memory/1188-66-0x00000000713A0000-0x0000000071421000-memory.dmpFilesize
516KB
-
memory/1188-84-0x0000000070C80000-0x000000007122B000-memory.dmpFilesize
5.7MB
-
memory/1188-83-0x000000006EE70000-0x000000006F6EA000-memory.dmpFilesize
8.5MB
-
memory/1188-82-0x00000000713A0000-0x0000000071421000-memory.dmpFilesize
516KB
-
memory/1188-61-0x0000000000000000-mapping.dmp
-
memory/1188-63-0x0000000070C80000-0x000000007122B000-memory.dmpFilesize
5.7MB
-
memory/1188-64-0x0000000070180000-0x0000000070C78000-memory.dmpFilesize
11.0MB
-
memory/1188-68-0x000000006EC30000-0x000000006EE65000-memory.dmpFilesize
2.2MB
-
memory/1188-85-0x0000000070180000-0x0000000070C78000-memory.dmpFilesize
11.0MB
-
memory/1188-86-0x000000006F9E0000-0x000000007017C000-memory.dmpFilesize
7.6MB
-
memory/1188-65-0x000000006F9E0000-0x000000007017C000-memory.dmpFilesize
7.6MB
-
memory/1188-69-0x0000000071350000-0x000000007139B000-memory.dmpFilesize
300KB
-
memory/1188-70-0x0000000074320000-0x0000000074345000-memory.dmpFilesize
148KB
-
memory/1188-71-0x000000006E920000-0x000000006E9E3000-memory.dmpFilesize
780KB
-
memory/1188-72-0x000000006E8F0000-0x000000006E91D000-memory.dmpFilesize
180KB
-
memory/1188-73-0x000000006E2A0000-0x000000006E3A4000-memory.dmpFilesize
1.0MB
-
memory/1188-74-0x000000006E180000-0x000000006E294000-memory.dmpFilesize
1.1MB
-
memory/1188-75-0x00000000712C0000-0x0000000071345000-memory.dmpFilesize
532KB
-
memory/1188-76-0x000000006EB90000-0x000000006EC2C000-memory.dmpFilesize
624KB
-
memory/1188-77-0x000000006E9F0000-0x000000006EB8E000-memory.dmpFilesize
1.6MB
-
memory/1188-79-0x000000006DB20000-0x000000006E171000-memory.dmpFilesize
6.3MB
-
memory/1668-80-0x0000000072F00000-0x000000007428F000-memory.dmpFilesize
19.6MB
-
memory/1668-99-0x0000000071D10000-0x00000000724F0000-memory.dmpFilesize
7.9MB
-
memory/1668-81-0x00000000724F0000-0x0000000072F00000-memory.dmpFilesize
10.1MB
-
memory/1668-60-0x00000000715D0000-0x0000000071D0E000-memory.dmpFilesize
7.2MB
-
memory/1668-59-0x0000000074BD0000-0x0000000074CCC000-memory.dmpFilesize
1008KB
-
memory/1668-58-0x0000000071D10000-0x00000000724F0000-memory.dmpFilesize
7.9MB
-
memory/1668-57-0x00000000724F0000-0x0000000072F00000-memory.dmpFilesize
10.1MB
-
memory/1668-56-0x0000000072F00000-0x000000007428F000-memory.dmpFilesize
19.6MB
-
memory/1668-87-0x00000000062F0000-0x00000000064BC000-memory.dmpFilesize
1.8MB
-
memory/1668-88-0x0000000002290000-0x00000000022DC000-memory.dmpFilesize
304KB
-
memory/1668-103-0x0000000072F00000-0x000000007428F000-memory.dmpFilesize
19.6MB
-
memory/1668-55-0x0000000075BF1000-0x0000000075BF3000-memory.dmpFilesize
8KB
-
memory/1668-101-0x00000000724F0000-0x0000000072F00000-memory.dmpFilesize
10.1MB
-
memory/1668-54-0x00000000001E0000-0x00000000001EE000-memory.dmpFilesize
56KB
-
memory/1772-91-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1772-94-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1772-96-0x00000000007E2740-mapping.dmp
-
memory/1772-97-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1772-98-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1772-92-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1772-95-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1772-102-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1772-106-0x0000000000260000-0x000000000026A000-memory.dmpFilesize
40KB
-
memory/1772-105-0x0000000000260000-0x000000000026A000-memory.dmpFilesize
40KB
-
memory/1772-109-0x0000000000260000-0x000000000026A000-memory.dmpFilesize
40KB
-
memory/1772-107-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1772-108-0x0000000000260000-0x000000000026A000-memory.dmpFilesize
40KB
-
memory/1932-89-0x0000000000000000-mapping.dmp