Analysis
-
max time kernel
175s -
max time network
193s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-06-2022 14:58
Static task
static1
Behavioral task
behavioral1
Sample
NIS75FJ4D_ETRANSFER_RECEIPT.exe
Resource
win7-20220414-en
General
-
Target
NIS75FJ4D_ETRANSFER_RECEIPT.exe
-
Size
300.0MB
-
MD5
d072528e13a5c62a4f27192472f757da
-
SHA1
361a23cc18bb659c6663e7e4d962c002ca89b716
-
SHA256
0cf97758629ff73febf6d092d1efa21076274de36257722e9f33ed71937b1c0b
-
SHA512
59dd288c9e820a575b2a977b07976e6c6b36f87e6dc8a6028e51cc8e6aae60668de1d4f9be9c34bc3489875fc3440727f47542a3c0ad48a19a83b5c03f5fb397
Malware Config
Extracted
bitrat
1.38
bitrat9300.duckdns.org:9300
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Executes dropped EXE 2 IoCs
Processes:
nhbyg.exenhbyg.exepid process 740 nhbyg.exe 1324 nhbyg.exe -
Processes:
resource yara_rule behavioral1/memory/1976-61-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1976-63-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1976-64-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1976-67-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1976-66-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1976-70-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1976-71-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1976-74-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1016-97-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1016-98-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
RegAsm.exeRegAsm.exepid process 1976 RegAsm.exe 1976 RegAsm.exe 1976 RegAsm.exe 1976 RegAsm.exe 1976 RegAsm.exe 1016 RegAsm.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
NIS75FJ4D_ETRANSFER_RECEIPT.exenhbyg.exedescription pid process target process PID 272 set thread context of 1976 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe RegAsm.exe PID 740 set thread context of 1016 740 nhbyg.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1480 schtasks.exe 1476 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RegAsm.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1976 RegAsm.exe Token: SeShutdownPrivilege 1976 RegAsm.exe Token: SeDebugPrivilege 1016 RegAsm.exe Token: SeShutdownPrivilege 1016 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 1976 RegAsm.exe 1976 RegAsm.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
NIS75FJ4D_ETRANSFER_RECEIPT.execmd.exetaskeng.exenhbyg.execmd.exedescription pid process target process PID 272 wrote to memory of 1808 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe cmd.exe PID 272 wrote to memory of 1808 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe cmd.exe PID 272 wrote to memory of 1808 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe cmd.exe PID 272 wrote to memory of 1808 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe cmd.exe PID 1808 wrote to memory of 1476 1808 cmd.exe schtasks.exe PID 1808 wrote to memory of 1476 1808 cmd.exe schtasks.exe PID 1808 wrote to memory of 1476 1808 cmd.exe schtasks.exe PID 1808 wrote to memory of 1476 1808 cmd.exe schtasks.exe PID 272 wrote to memory of 1116 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe cmd.exe PID 272 wrote to memory of 1116 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe cmd.exe PID 272 wrote to memory of 1116 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe cmd.exe PID 272 wrote to memory of 1116 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe cmd.exe PID 272 wrote to memory of 1976 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe RegAsm.exe PID 272 wrote to memory of 1976 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe RegAsm.exe PID 272 wrote to memory of 1976 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe RegAsm.exe PID 272 wrote to memory of 1976 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe RegAsm.exe PID 272 wrote to memory of 1976 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe RegAsm.exe PID 272 wrote to memory of 1976 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe RegAsm.exe PID 272 wrote to memory of 1976 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe RegAsm.exe PID 272 wrote to memory of 1976 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe RegAsm.exe PID 272 wrote to memory of 1976 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe RegAsm.exe PID 272 wrote to memory of 1976 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe RegAsm.exe PID 272 wrote to memory of 1976 272 NIS75FJ4D_ETRANSFER_RECEIPT.exe RegAsm.exe PID 1348 wrote to memory of 740 1348 taskeng.exe nhbyg.exe PID 1348 wrote to memory of 740 1348 taskeng.exe nhbyg.exe PID 1348 wrote to memory of 740 1348 taskeng.exe nhbyg.exe PID 1348 wrote to memory of 740 1348 taskeng.exe nhbyg.exe PID 740 wrote to memory of 1032 740 nhbyg.exe cmd.exe PID 740 wrote to memory of 1032 740 nhbyg.exe cmd.exe PID 740 wrote to memory of 1032 740 nhbyg.exe cmd.exe PID 740 wrote to memory of 1032 740 nhbyg.exe cmd.exe PID 1032 wrote to memory of 1480 1032 cmd.exe schtasks.exe PID 1032 wrote to memory of 1480 1032 cmd.exe schtasks.exe PID 1032 wrote to memory of 1480 1032 cmd.exe schtasks.exe PID 1032 wrote to memory of 1480 1032 cmd.exe schtasks.exe PID 740 wrote to memory of 1140 740 nhbyg.exe cmd.exe PID 740 wrote to memory of 1140 740 nhbyg.exe cmd.exe PID 740 wrote to memory of 1140 740 nhbyg.exe cmd.exe PID 740 wrote to memory of 1140 740 nhbyg.exe cmd.exe PID 740 wrote to memory of 1016 740 nhbyg.exe RegAsm.exe PID 740 wrote to memory of 1016 740 nhbyg.exe RegAsm.exe PID 740 wrote to memory of 1016 740 nhbyg.exe RegAsm.exe PID 740 wrote to memory of 1016 740 nhbyg.exe RegAsm.exe PID 740 wrote to memory of 1016 740 nhbyg.exe RegAsm.exe PID 740 wrote to memory of 1016 740 nhbyg.exe RegAsm.exe PID 740 wrote to memory of 1016 740 nhbyg.exe RegAsm.exe PID 740 wrote to memory of 1016 740 nhbyg.exe RegAsm.exe PID 740 wrote to memory of 1016 740 nhbyg.exe RegAsm.exe PID 740 wrote to memory of 1016 740 nhbyg.exe RegAsm.exe PID 740 wrote to memory of 1016 740 nhbyg.exe RegAsm.exe PID 1348 wrote to memory of 1324 1348 taskeng.exe nhbyg.exe PID 1348 wrote to memory of 1324 1348 taskeng.exe nhbyg.exe PID 1348 wrote to memory of 1324 1348 taskeng.exe nhbyg.exe PID 1348 wrote to memory of 1324 1348 taskeng.exe nhbyg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NIS75FJ4D_ETRANSFER_RECEIPT.exe"C:\Users\Admin\AppData\Local\Temp\NIS75FJ4D_ETRANSFER_RECEIPT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\nhbyg.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\nhbyg.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\NIS75FJ4D_ETRANSFER_RECEIPT.exe" "C:\Users\Admin\AppData\Roaming\nhbyg.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskeng.exetaskeng.exe {396F7219-E290-4F8C-8701-CD00A74A19AC} S-1-5-21-1083475884-596052423-1669053738-1000:WYZSGDWS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\nhbyg.exeC:\Users\Admin\AppData\Roaming\nhbyg.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\nhbyg.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\nhbyg.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\nhbyg.exe" "C:\Users\Admin\AppData\Roaming\nhbyg.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\nhbyg.exeC:\Users\Admin\AppData\Roaming\nhbyg.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\nhbyg.exeFilesize
300.0MB
MD5d072528e13a5c62a4f27192472f757da
SHA1361a23cc18bb659c6663e7e4d962c002ca89b716
SHA2560cf97758629ff73febf6d092d1efa21076274de36257722e9f33ed71937b1c0b
SHA51259dd288c9e820a575b2a977b07976e6c6b36f87e6dc8a6028e51cc8e6aae60668de1d4f9be9c34bc3489875fc3440727f47542a3c0ad48a19a83b5c03f5fb397
-
C:\Users\Admin\AppData\Roaming\nhbyg.exeFilesize
300.0MB
MD5d072528e13a5c62a4f27192472f757da
SHA1361a23cc18bb659c6663e7e4d962c002ca89b716
SHA2560cf97758629ff73febf6d092d1efa21076274de36257722e9f33ed71937b1c0b
SHA51259dd288c9e820a575b2a977b07976e6c6b36f87e6dc8a6028e51cc8e6aae60668de1d4f9be9c34bc3489875fc3440727f47542a3c0ad48a19a83b5c03f5fb397
-
C:\Users\Admin\AppData\Roaming\nhbyg.exeFilesize
300.0MB
MD5d072528e13a5c62a4f27192472f757da
SHA1361a23cc18bb659c6663e7e4d962c002ca89b716
SHA2560cf97758629ff73febf6d092d1efa21076274de36257722e9f33ed71937b1c0b
SHA51259dd288c9e820a575b2a977b07976e6c6b36f87e6dc8a6028e51cc8e6aae60668de1d4f9be9c34bc3489875fc3440727f47542a3c0ad48a19a83b5c03f5fb397
-
memory/272-54-0x0000000000C90000-0x0000000000E24000-memory.dmpFilesize
1.6MB
-
memory/272-55-0x00000000753B1000-0x00000000753B3000-memory.dmpFilesize
8KB
-
memory/272-56-0x0000000005450000-0x00000000055C6000-memory.dmpFilesize
1.5MB
-
memory/740-80-0x0000000000390000-0x0000000000524000-memory.dmpFilesize
1.6MB
-
memory/740-78-0x0000000000000000-mapping.dmp
-
memory/1016-90-0x00000000007E2730-mapping.dmp
-
memory/1016-98-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1016-97-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1032-82-0x0000000000000000-mapping.dmp
-
memory/1116-59-0x0000000000000000-mapping.dmp
-
memory/1140-84-0x0000000000000000-mapping.dmp
-
memory/1324-99-0x0000000000000000-mapping.dmp
-
memory/1324-101-0x00000000003A0000-0x0000000000534000-memory.dmpFilesize
1.6MB
-
memory/1476-58-0x0000000000000000-mapping.dmp
-
memory/1480-83-0x0000000000000000-mapping.dmp
-
memory/1808-57-0x0000000000000000-mapping.dmp
-
memory/1976-63-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1976-76-0x0000000000120000-0x000000000012A000-memory.dmpFilesize
40KB
-
memory/1976-75-0x0000000000120000-0x000000000012A000-memory.dmpFilesize
40KB
-
memory/1976-74-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1976-73-0x0000000000120000-0x000000000012A000-memory.dmpFilesize
40KB
-
memory/1976-72-0x0000000000120000-0x000000000012A000-memory.dmpFilesize
40KB
-
memory/1976-71-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1976-70-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1976-66-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1976-67-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1976-65-0x00000000007E2730-mapping.dmp
-
memory/1976-64-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1976-61-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1976-60-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB