Analysis
-
max time kernel
172s -
max time network
201s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-06-2022 19:48
Static task
static1
Behavioral task
behavioral1
Sample
D7M39A87SH3-ETRANSFER-RECEIPT.exe
Resource
win7-20220414-en
General
-
Target
D7M39A87SH3-ETRANSFER-RECEIPT.exe
-
Size
300.0MB
-
MD5
edd26deecff12183dc818957f18b866a
-
SHA1
7e4fc7d57f7502ad210ceafbe294716981585281
-
SHA256
0b6306bc128b16b99cee0d04e4427bc0b5dbe32b2386fc4800cf42c9f42ed3b3
-
SHA512
b86225d429f244077f1a4313318e034320da2091a02a8064065b2fbd290eaa5285adfe90a161886f6a13dcba996f536da6758da78cf54ec01c900369db841987
Malware Config
Extracted
bitrat
1.38
bitrat9300.duckdns.org:9300
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Executes dropped EXE 1 IoCs
Processes:
vhhg.exepid process 568 vhhg.exe -
Processes:
resource yara_rule behavioral1/memory/1232-61-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1232-63-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1232-64-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1232-66-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1232-67-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1232-70-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1232-71-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1232-72-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1232-74-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1688-98-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1688-99-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
RegAsm.exeRegAsm.exepid process 1232 RegAsm.exe 1232 RegAsm.exe 1232 RegAsm.exe 1232 RegAsm.exe 1232 RegAsm.exe 1688 RegAsm.exe 1232 RegAsm.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
D7M39A87SH3-ETRANSFER-RECEIPT.exevhhg.exedescription pid process target process PID 1680 set thread context of 1232 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 568 set thread context of 1688 568 vhhg.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2044 schtasks.exe 1180 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RegAsm.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1232 RegAsm.exe Token: SeShutdownPrivilege 1232 RegAsm.exe Token: SeDebugPrivilege 1688 RegAsm.exe Token: SeShutdownPrivilege 1688 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 1232 RegAsm.exe 1232 RegAsm.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
D7M39A87SH3-ETRANSFER-RECEIPT.execmd.exetaskeng.exevhhg.execmd.exedescription pid process target process PID 1680 wrote to memory of 1992 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 1680 wrote to memory of 1992 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 1680 wrote to memory of 1992 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 1680 wrote to memory of 1992 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 1992 wrote to memory of 2044 1992 cmd.exe schtasks.exe PID 1992 wrote to memory of 2044 1992 cmd.exe schtasks.exe PID 1992 wrote to memory of 2044 1992 cmd.exe schtasks.exe PID 1992 wrote to memory of 2044 1992 cmd.exe schtasks.exe PID 1680 wrote to memory of 1996 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 1680 wrote to memory of 1996 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 1680 wrote to memory of 1996 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 1680 wrote to memory of 1996 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 1680 wrote to memory of 1232 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1680 wrote to memory of 1232 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1680 wrote to memory of 1232 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1680 wrote to memory of 1232 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1680 wrote to memory of 1232 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1680 wrote to memory of 1232 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1680 wrote to memory of 1232 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1680 wrote to memory of 1232 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1680 wrote to memory of 1232 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1680 wrote to memory of 1232 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1680 wrote to memory of 1232 1680 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1176 wrote to memory of 568 1176 taskeng.exe vhhg.exe PID 1176 wrote to memory of 568 1176 taskeng.exe vhhg.exe PID 1176 wrote to memory of 568 1176 taskeng.exe vhhg.exe PID 1176 wrote to memory of 568 1176 taskeng.exe vhhg.exe PID 568 wrote to memory of 1908 568 vhhg.exe cmd.exe PID 568 wrote to memory of 1908 568 vhhg.exe cmd.exe PID 568 wrote to memory of 1908 568 vhhg.exe cmd.exe PID 568 wrote to memory of 1908 568 vhhg.exe cmd.exe PID 1908 wrote to memory of 1180 1908 cmd.exe schtasks.exe PID 1908 wrote to memory of 1180 1908 cmd.exe schtasks.exe PID 1908 wrote to memory of 1180 1908 cmd.exe schtasks.exe PID 1908 wrote to memory of 1180 1908 cmd.exe schtasks.exe PID 568 wrote to memory of 1920 568 vhhg.exe cmd.exe PID 568 wrote to memory of 1920 568 vhhg.exe cmd.exe PID 568 wrote to memory of 1920 568 vhhg.exe cmd.exe PID 568 wrote to memory of 1920 568 vhhg.exe cmd.exe PID 568 wrote to memory of 1688 568 vhhg.exe RegAsm.exe PID 568 wrote to memory of 1688 568 vhhg.exe RegAsm.exe PID 568 wrote to memory of 1688 568 vhhg.exe RegAsm.exe PID 568 wrote to memory of 1688 568 vhhg.exe RegAsm.exe PID 568 wrote to memory of 1688 568 vhhg.exe RegAsm.exe PID 568 wrote to memory of 1688 568 vhhg.exe RegAsm.exe PID 568 wrote to memory of 1688 568 vhhg.exe RegAsm.exe PID 568 wrote to memory of 1688 568 vhhg.exe RegAsm.exe PID 568 wrote to memory of 1688 568 vhhg.exe RegAsm.exe PID 568 wrote to memory of 1688 568 vhhg.exe RegAsm.exe PID 568 wrote to memory of 1688 568 vhhg.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\D7M39A87SH3-ETRANSFER-RECEIPT.exe"C:\Users\Admin\AppData\Local\Temp\D7M39A87SH3-ETRANSFER-RECEIPT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\D7M39A87SH3-ETRANSFER-RECEIPT.exe" "C:\Users\Admin\AppData\Roaming\vhhg.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskeng.exetaskeng.exe {41CB11BC-0901-490C-999C-745570BC09FB} S-1-5-21-2277218442-1199762539-2004043321-1000:AUVQQRRF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vhhg.exeC:\Users\Admin\AppData\Roaming\vhhg.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\vhhg.exe" "C:\Users\Admin\AppData\Roaming\vhhg.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\vhhg.exeFilesize
300.0MB
MD5edd26deecff12183dc818957f18b866a
SHA17e4fc7d57f7502ad210ceafbe294716981585281
SHA2560b6306bc128b16b99cee0d04e4427bc0b5dbe32b2386fc4800cf42c9f42ed3b3
SHA512b86225d429f244077f1a4313318e034320da2091a02a8064065b2fbd290eaa5285adfe90a161886f6a13dcba996f536da6758da78cf54ec01c900369db841987
-
C:\Users\Admin\AppData\Roaming\vhhg.exeFilesize
266.6MB
MD5b01b8de55ecbf34528c93879b8a72031
SHA1d70b69df6aaffcda2ebc8000807276fa8f9b7cda
SHA2566c62b3fd10dfc419f60c8dfa4a3a4fe424b587524f74fb9bf288ff2e28892509
SHA512342e95e9bcd5039be2b53dcc3c3e8c0b9f3eb7d2e39516fe74580885dd79d339a11a12ce179a77d746dc099417301c2ca114192b881b2a8a6ca846acf0b68d09
-
memory/568-77-0x00000000012B0000-0x0000000001442000-memory.dmpFilesize
1.6MB
-
memory/568-75-0x0000000000000000-mapping.dmp
-
memory/1180-84-0x0000000000000000-mapping.dmp
-
memory/1232-63-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1232-82-0x0000000000260000-0x000000000026A000-memory.dmpFilesize
40KB
-
memory/1232-61-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1232-101-0x0000000000260000-0x000000000026A000-memory.dmpFilesize
40KB
-
memory/1232-64-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1232-65-0x00000000007E2730-mapping.dmp
-
memory/1232-66-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1232-67-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1232-70-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1232-71-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1232-72-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1232-100-0x0000000000260000-0x000000000026A000-memory.dmpFilesize
40KB
-
memory/1232-74-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1232-60-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1232-81-0x0000000000260000-0x000000000026A000-memory.dmpFilesize
40KB
-
memory/1232-80-0x0000000000260000-0x000000000026A000-memory.dmpFilesize
40KB
-
memory/1232-79-0x0000000000260000-0x000000000026A000-memory.dmpFilesize
40KB
-
memory/1680-56-0x00000000052E0000-0x0000000005456000-memory.dmpFilesize
1.5MB
-
memory/1680-55-0x0000000075C51000-0x0000000075C53000-memory.dmpFilesize
8KB
-
memory/1680-54-0x00000000010D0000-0x0000000001262000-memory.dmpFilesize
1.6MB
-
memory/1688-91-0x00000000007E2730-mapping.dmp
-
memory/1688-98-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1688-99-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1908-83-0x0000000000000000-mapping.dmp
-
memory/1920-85-0x0000000000000000-mapping.dmp
-
memory/1992-57-0x0000000000000000-mapping.dmp
-
memory/1996-59-0x0000000000000000-mapping.dmp
-
memory/2044-58-0x0000000000000000-mapping.dmp