Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
14-06-2022 16:31
Static task
static1
Behavioral task
behavioral1
Sample
C8D6C4G3_ETRANSFER_RECEIPT.exe
Resource
win7-20220414-en
General
-
Target
C8D6C4G3_ETRANSFER_RECEIPT.exe
-
Size
300.0MB
-
MD5
bfabfe78aa78696e50b54618f8b828e6
-
SHA1
10444cddc6fd263a1b4a3ee8fa477a3a1e673f81
-
SHA256
5d40878b671c96e0c31b04b38d416c808fe231b1eaade5b4e1bdf5345b371a2b
-
SHA512
75b739af5a7a84b740175bdb0d95a6c91ff38f6c52aacfaf82f61da2edb491bbf38494a21f09a83706509d7bdf1bcaaa14707bb61dcc1f32e7bc73fa8033a3b5
Malware Config
Extracted
bitrat
1.38
bitrat9300.duckdns.org:9300
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Executes dropped EXE 3 IoCs
Processes:
retwvs.exeretwvs.exeretwvs.exepid process 1820 retwvs.exe 1848 retwvs.exe 3960 retwvs.exe -
Processes:
resource yara_rule behavioral2/memory/3628-136-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3628-139-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3628-138-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3628-137-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3628-140-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3628-143-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1848-152-0x0000000000A10000-0x0000000000DF4000-memory.dmp upx behavioral2/memory/1848-153-0x0000000000A10000-0x0000000000DF4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
C8D6C4G3_ETRANSFER_RECEIPT.exepid process 3628 C8D6C4G3_ETRANSFER_RECEIPT.exe 3628 C8D6C4G3_ETRANSFER_RECEIPT.exe 3628 C8D6C4G3_ETRANSFER_RECEIPT.exe 3628 C8D6C4G3_ETRANSFER_RECEIPT.exe 3628 C8D6C4G3_ETRANSFER_RECEIPT.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
C8D6C4G3_ETRANSFER_RECEIPT.exeretwvs.exedescription pid process target process PID 1048 set thread context of 3628 1048 C8D6C4G3_ETRANSFER_RECEIPT.exe C8D6C4G3_ETRANSFER_RECEIPT.exe PID 1820 set thread context of 1848 1820 retwvs.exe retwvs.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1356 1848 WerFault.exe retwvs.exe 3724 1848 WerFault.exe retwvs.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2676 schtasks.exe 3756 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
C8D6C4G3_ETRANSFER_RECEIPT.exedescription pid process Token: SeShutdownPrivilege 3628 C8D6C4G3_ETRANSFER_RECEIPT.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
C8D6C4G3_ETRANSFER_RECEIPT.exepid process 3628 C8D6C4G3_ETRANSFER_RECEIPT.exe 3628 C8D6C4G3_ETRANSFER_RECEIPT.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
C8D6C4G3_ETRANSFER_RECEIPT.execmd.exeretwvs.execmd.exedescription pid process target process PID 1048 wrote to memory of 212 1048 C8D6C4G3_ETRANSFER_RECEIPT.exe cmd.exe PID 1048 wrote to memory of 212 1048 C8D6C4G3_ETRANSFER_RECEIPT.exe cmd.exe PID 1048 wrote to memory of 212 1048 C8D6C4G3_ETRANSFER_RECEIPT.exe cmd.exe PID 212 wrote to memory of 2676 212 cmd.exe schtasks.exe PID 212 wrote to memory of 2676 212 cmd.exe schtasks.exe PID 212 wrote to memory of 2676 212 cmd.exe schtasks.exe PID 1048 wrote to memory of 4136 1048 C8D6C4G3_ETRANSFER_RECEIPT.exe cmd.exe PID 1048 wrote to memory of 4136 1048 C8D6C4G3_ETRANSFER_RECEIPT.exe cmd.exe PID 1048 wrote to memory of 4136 1048 C8D6C4G3_ETRANSFER_RECEIPT.exe cmd.exe PID 1048 wrote to memory of 3628 1048 C8D6C4G3_ETRANSFER_RECEIPT.exe C8D6C4G3_ETRANSFER_RECEIPT.exe PID 1048 wrote to memory of 3628 1048 C8D6C4G3_ETRANSFER_RECEIPT.exe C8D6C4G3_ETRANSFER_RECEIPT.exe PID 1048 wrote to memory of 3628 1048 C8D6C4G3_ETRANSFER_RECEIPT.exe C8D6C4G3_ETRANSFER_RECEIPT.exe PID 1048 wrote to memory of 3628 1048 C8D6C4G3_ETRANSFER_RECEIPT.exe C8D6C4G3_ETRANSFER_RECEIPT.exe PID 1048 wrote to memory of 3628 1048 C8D6C4G3_ETRANSFER_RECEIPT.exe C8D6C4G3_ETRANSFER_RECEIPT.exe PID 1048 wrote to memory of 3628 1048 C8D6C4G3_ETRANSFER_RECEIPT.exe C8D6C4G3_ETRANSFER_RECEIPT.exe PID 1048 wrote to memory of 3628 1048 C8D6C4G3_ETRANSFER_RECEIPT.exe C8D6C4G3_ETRANSFER_RECEIPT.exe PID 1820 wrote to memory of 4232 1820 retwvs.exe cmd.exe PID 1820 wrote to memory of 4232 1820 retwvs.exe cmd.exe PID 1820 wrote to memory of 4232 1820 retwvs.exe cmd.exe PID 4232 wrote to memory of 3756 4232 cmd.exe schtasks.exe PID 4232 wrote to memory of 3756 4232 cmd.exe schtasks.exe PID 4232 wrote to memory of 3756 4232 cmd.exe schtasks.exe PID 1820 wrote to memory of 1936 1820 retwvs.exe cmd.exe PID 1820 wrote to memory of 1936 1820 retwvs.exe cmd.exe PID 1820 wrote to memory of 1936 1820 retwvs.exe cmd.exe PID 1820 wrote to memory of 1848 1820 retwvs.exe retwvs.exe PID 1820 wrote to memory of 1848 1820 retwvs.exe retwvs.exe PID 1820 wrote to memory of 1848 1820 retwvs.exe retwvs.exe PID 1820 wrote to memory of 1848 1820 retwvs.exe retwvs.exe PID 1820 wrote to memory of 1848 1820 retwvs.exe retwvs.exe PID 1820 wrote to memory of 1848 1820 retwvs.exe retwvs.exe PID 1820 wrote to memory of 1848 1820 retwvs.exe retwvs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\C8D6C4G3_ETRANSFER_RECEIPT.exe"C:\Users\Admin\AppData\Local\Temp\C8D6C4G3_ETRANSFER_RECEIPT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\retwvs.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\retwvs.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\C8D6C4G3_ETRANSFER_RECEIPT.exe" "C:\Users\Admin\AppData\Roaming\retwvs.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\C8D6C4G3_ETRANSFER_RECEIPT.exe"C:\Users\Admin\AppData\Local\Temp\C8D6C4G3_ETRANSFER_RECEIPT.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\retwvs.exeC:\Users\Admin\AppData\Roaming\retwvs.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\retwvs.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\retwvs.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\retwvs.exe" "C:\Users\Admin\AppData\Roaming\retwvs.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\retwvs.exe"C:\Users\Admin\AppData\Roaming\retwvs.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 1843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 1883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1848 -ip 18481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1848 -ip 18481⤵
-
C:\Users\Admin\AppData\Roaming\retwvs.exeC:\Users\Admin\AppData\Roaming\retwvs.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\retwvs.exe.logFilesize
520B
MD503febbff58da1d3318c31657d89c8542
SHA1c9e017bd9d0a4fe533795b227c855935d86c2092
SHA2565164770a37b199a79ccd23b399bb3309228973d9f74c589bc2623dc613b37ac4
SHA5123750c372bbca1892e9c1b34681d592c693e725a8b149c3d6938079cd467628cec42c4293b0d886b57a786abf45f5e7229247b3445001774e3e793ff5a3accfa3
-
C:\Users\Admin\AppData\Roaming\retwvs.exeFilesize
300.0MB
MD5bfabfe78aa78696e50b54618f8b828e6
SHA110444cddc6fd263a1b4a3ee8fa477a3a1e673f81
SHA2565d40878b671c96e0c31b04b38d416c808fe231b1eaade5b4e1bdf5345b371a2b
SHA51275b739af5a7a84b740175bdb0d95a6c91ff38f6c52aacfaf82f61da2edb491bbf38494a21f09a83706509d7bdf1bcaaa14707bb61dcc1f32e7bc73fa8033a3b5
-
C:\Users\Admin\AppData\Roaming\retwvs.exeFilesize
300.0MB
MD5bfabfe78aa78696e50b54618f8b828e6
SHA110444cddc6fd263a1b4a3ee8fa477a3a1e673f81
SHA2565d40878b671c96e0c31b04b38d416c808fe231b1eaade5b4e1bdf5345b371a2b
SHA51275b739af5a7a84b740175bdb0d95a6c91ff38f6c52aacfaf82f61da2edb491bbf38494a21f09a83706509d7bdf1bcaaa14707bb61dcc1f32e7bc73fa8033a3b5
-
C:\Users\Admin\AppData\Roaming\retwvs.exeFilesize
290.9MB
MD54cba9c5c4e7566c9ecd08d8af3b66fc1
SHA100a920c13a95813d3af3b0953a91e85b60c2c24c
SHA256808c3c89f14114bbd0a43390689426c1e23624993c70c31a0a4e9e2baa5f87aa
SHA512d4501968bbd5b281e2b6a3433573820bc0d53606a3822f9b1ce40eee79b7c2e806cd4efd0922028bc5df5d29d34cd1995f4f5feeb281fb8b44301e25e2ff6f8a
-
C:\Users\Admin\AppData\Roaming\retwvs.exeFilesize
102.6MB
MD53c4eda5f977bd92605af1d37a70e2918
SHA1a22f8c53406123dd356e270ff2f80b40219fb27b
SHA256234a637e373418471caa81b888775f1fb5f65788b6d8e2cb4b156c9c1d7f4999
SHA5127a11bd71bfcbda5b07355cb48bcfad5efc2d003b361599ac759794223cee17cb2b8b3f24113790bee150c117dfc4dcb9a8014a400280f2947a1799d7e70545ee
-
memory/212-132-0x0000000000000000-mapping.dmp
-
memory/1048-130-0x0000000000060000-0x00000000001F4000-memory.dmpFilesize
1.6MB
-
memory/1048-131-0x00000000051D0000-0x0000000005774000-memory.dmpFilesize
5.6MB
-
memory/1848-153-0x0000000000A10000-0x0000000000DF4000-memory.dmpFilesize
3.9MB
-
memory/1848-152-0x0000000000A10000-0x0000000000DF4000-memory.dmpFilesize
3.9MB
-
memory/1848-149-0x0000000000000000-mapping.dmp
-
memory/1936-148-0x0000000000000000-mapping.dmp
-
memory/2676-133-0x0000000000000000-mapping.dmp
-
memory/3628-136-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3628-143-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3628-142-0x0000000074A80000-0x0000000074AB9000-memory.dmpFilesize
228KB
-
memory/3628-141-0x00000000746E0000-0x0000000074719000-memory.dmpFilesize
228KB
-
memory/3628-140-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3628-137-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3628-138-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3628-139-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3628-135-0x0000000000000000-mapping.dmp
-
memory/3756-147-0x0000000000000000-mapping.dmp
-
memory/4136-134-0x0000000000000000-mapping.dmp
-
memory/4232-146-0x0000000000000000-mapping.dmp