Analysis
-
max time kernel
176s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-06-2022 19:48
Static task
static1
Behavioral task
behavioral1
Sample
D7M39A87SH3-ETRANSFER-RECEIPT.exe
Resource
win7-20220414-en
General
-
Target
D7M39A87SH3-ETRANSFER-RECEIPT.exe
-
Size
300.0MB
-
MD5
edd26deecff12183dc818957f18b866a
-
SHA1
7e4fc7d57f7502ad210ceafbe294716981585281
-
SHA256
0b6306bc128b16b99cee0d04e4427bc0b5dbe32b2386fc4800cf42c9f42ed3b3
-
SHA512
b86225d429f244077f1a4313318e034320da2091a02a8064065b2fbd290eaa5285adfe90a161886f6a13dcba996f536da6758da78cf54ec01c900369db841987
Malware Config
Extracted
bitrat
1.38
bitrat9300.duckdns.org:9300
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Executes dropped EXE 2 IoCs
Processes:
vhhg.exevhhg.exepid process 4368 vhhg.exe 1112 vhhg.exe -
Processes:
resource yara_rule behavioral2/memory/4404-136-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4404-137-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4404-138-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4404-139-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4404-140-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4404-143-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1356-152-0x0000000000700000-0x0000000000AE4000-memory.dmp upx behavioral2/memory/1356-153-0x0000000000700000-0x0000000000AE4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
RegAsm.exepid process 4404 RegAsm.exe 4404 RegAsm.exe 4404 RegAsm.exe 4404 RegAsm.exe 4404 RegAsm.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
D7M39A87SH3-ETRANSFER-RECEIPT.exevhhg.exedescription pid process target process PID 3792 set thread context of 4404 3792 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 4368 set thread context of 1356 4368 vhhg.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2064 1356 WerFault.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4528 schtasks.exe 3856 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeShutdownPrivilege 4404 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 4404 RegAsm.exe 4404 RegAsm.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
D7M39A87SH3-ETRANSFER-RECEIPT.execmd.exevhhg.execmd.exevhhg.exedescription pid process target process PID 3792 wrote to memory of 396 3792 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 3792 wrote to memory of 396 3792 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 3792 wrote to memory of 396 3792 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 396 wrote to memory of 4528 396 cmd.exe schtasks.exe PID 396 wrote to memory of 4528 396 cmd.exe schtasks.exe PID 396 wrote to memory of 4528 396 cmd.exe schtasks.exe PID 3792 wrote to memory of 4420 3792 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 3792 wrote to memory of 4420 3792 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 3792 wrote to memory of 4420 3792 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 3792 wrote to memory of 4404 3792 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 3792 wrote to memory of 4404 3792 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 3792 wrote to memory of 4404 3792 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 3792 wrote to memory of 4404 3792 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 3792 wrote to memory of 4404 3792 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 3792 wrote to memory of 4404 3792 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 3792 wrote to memory of 4404 3792 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 4368 wrote to memory of 2012 4368 vhhg.exe cmd.exe PID 4368 wrote to memory of 2012 4368 vhhg.exe cmd.exe PID 4368 wrote to memory of 2012 4368 vhhg.exe cmd.exe PID 2012 wrote to memory of 3856 2012 cmd.exe schtasks.exe PID 2012 wrote to memory of 3856 2012 cmd.exe schtasks.exe PID 2012 wrote to memory of 3856 2012 cmd.exe schtasks.exe PID 4368 wrote to memory of 3788 4368 vhhg.exe cmd.exe PID 4368 wrote to memory of 3788 4368 vhhg.exe cmd.exe PID 4368 wrote to memory of 3788 4368 vhhg.exe cmd.exe PID 4368 wrote to memory of 1356 4368 vhhg.exe RegAsm.exe PID 4368 wrote to memory of 1356 4368 vhhg.exe RegAsm.exe PID 4368 wrote to memory of 1356 4368 vhhg.exe RegAsm.exe PID 4368 wrote to memory of 1356 4368 vhhg.exe RegAsm.exe PID 4368 wrote to memory of 1356 4368 vhhg.exe RegAsm.exe PID 4368 wrote to memory of 1356 4368 vhhg.exe RegAsm.exe PID 4368 wrote to memory of 1356 4368 vhhg.exe RegAsm.exe PID 1112 wrote to memory of 2468 1112 vhhg.exe cmd.exe PID 1112 wrote to memory of 2468 1112 vhhg.exe cmd.exe PID 1112 wrote to memory of 2468 1112 vhhg.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\D7M39A87SH3-ETRANSFER-RECEIPT.exe"C:\Users\Admin\AppData\Local\Temp\D7M39A87SH3-ETRANSFER-RECEIPT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\D7M39A87SH3-ETRANSFER-RECEIPT.exe" "C:\Users\Admin\AppData\Roaming\vhhg.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\vhhg.exeC:\Users\Admin\AppData\Roaming\vhhg.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\vhhg.exe" "C:\Users\Admin\AppData\Roaming\vhhg.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 5403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1356 -ip 13561⤵
-
C:\Users\Admin\AppData\Roaming\vhhg.exeC:\Users\Admin\AppData\Roaming\vhhg.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vhhg.exe.logFilesize
520B
MD541c37de2b4598f7759f865817dba5f80
SHA1884ccf344bc2dd409425dc5ace0fd909a5f8cce4
SHA256427235491a8da3fc8770ed60d30af731835c94585cd08d4d81fca9f703b283bc
SHA512a8f3c74916623de100e4cf22e05df9cdf541b1e32443aab0434f35fb9c4a7fa950b997ce589b532e65731ae471a1f152cd5c00ea1df4bd7a6b57eb27c93c54bd
-
C:\Users\Admin\AppData\Roaming\vhhg.exeFilesize
300.0MB
MD5edd26deecff12183dc818957f18b866a
SHA17e4fc7d57f7502ad210ceafbe294716981585281
SHA2560b6306bc128b16b99cee0d04e4427bc0b5dbe32b2386fc4800cf42c9f42ed3b3
SHA512b86225d429f244077f1a4313318e034320da2091a02a8064065b2fbd290eaa5285adfe90a161886f6a13dcba996f536da6758da78cf54ec01c900369db841987
-
C:\Users\Admin\AppData\Roaming\vhhg.exeFilesize
300.0MB
MD5edd26deecff12183dc818957f18b866a
SHA17e4fc7d57f7502ad210ceafbe294716981585281
SHA2560b6306bc128b16b99cee0d04e4427bc0b5dbe32b2386fc4800cf42c9f42ed3b3
SHA512b86225d429f244077f1a4313318e034320da2091a02a8064065b2fbd290eaa5285adfe90a161886f6a13dcba996f536da6758da78cf54ec01c900369db841987
-
C:\Users\Admin\AppData\Roaming\vhhg.exeFilesize
113.7MB
MD51e532e3b7618ace7c51461499ae3bf43
SHA182f2ae5480e6eb1f1088681ee50d79e57bb3a0ea
SHA256c59add524b8ba156fed88696cd9c9dc93f984a2e4426dfde355d4579e65af349
SHA51237b4828c8af254d49ee0673213f8e650d9d2c6f3f259aeb117521c4bae8e9628e8d2b60d9d75d938408aa2f84e694b34df9e5bf32f6daffe68d57dfd1bf1d2e1
-
memory/396-131-0x0000000000000000-mapping.dmp
-
memory/1356-152-0x0000000000700000-0x0000000000AE4000-memory.dmpFilesize
3.9MB
-
memory/1356-153-0x0000000000700000-0x0000000000AE4000-memory.dmpFilesize
3.9MB
-
memory/1356-150-0x0000000000000000-mapping.dmp
-
memory/2012-147-0x0000000000000000-mapping.dmp
-
memory/2468-160-0x0000000000000000-mapping.dmp
-
memory/3788-149-0x0000000000000000-mapping.dmp
-
memory/3792-133-0x0000000005FA0000-0x0000000006544000-memory.dmpFilesize
5.6MB
-
memory/3792-130-0x00000000009A0000-0x0000000000B32000-memory.dmpFilesize
1.6MB
-
memory/3856-148-0x0000000000000000-mapping.dmp
-
memory/4404-139-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4404-136-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4404-135-0x0000000000000000-mapping.dmp
-
memory/4404-143-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4404-154-0x0000000075080000-0x00000000750B9000-memory.dmpFilesize
228KB
-
memory/4404-142-0x0000000075480000-0x00000000754B9000-memory.dmpFilesize
228KB
-
memory/4404-141-0x00000000750E0000-0x0000000075119000-memory.dmpFilesize
228KB
-
memory/4404-138-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4404-146-0x00000000751A0000-0x00000000751D9000-memory.dmpFilesize
228KB
-
memory/4404-161-0x00000000751A0000-0x00000000751D9000-memory.dmpFilesize
228KB
-
memory/4404-140-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4404-137-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4404-157-0x00000000750E0000-0x0000000075119000-memory.dmpFilesize
228KB
-
memory/4404-158-0x0000000075480000-0x00000000754B9000-memory.dmpFilesize
228KB
-
memory/4404-159-0x00000000751A0000-0x00000000751D9000-memory.dmpFilesize
228KB
-
memory/4420-134-0x0000000000000000-mapping.dmp
-
memory/4528-132-0x0000000000000000-mapping.dmp