Analysis
-
max time kernel
153s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
17-06-2022 11:35
Static task
static1
Behavioral task
behavioral1
Sample
D7M39A87SH3-ETRANSFER-RECEIPT.exe
Resource
win7-20220414-en
General
-
Target
D7M39A87SH3-ETRANSFER-RECEIPT.exe
-
Size
300.0MB
-
MD5
edd26deecff12183dc818957f18b866a
-
SHA1
7e4fc7d57f7502ad210ceafbe294716981585281
-
SHA256
0b6306bc128b16b99cee0d04e4427bc0b5dbe32b2386fc4800cf42c9f42ed3b3
-
SHA512
b86225d429f244077f1a4313318e034320da2091a02a8064065b2fbd290eaa5285adfe90a161886f6a13dcba996f536da6758da78cf54ec01c900369db841987
Malware Config
Extracted
bitrat
1.38
bitrat9300.duckdns.org:9300
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Executes dropped EXE 2 IoCs
Processes:
vhhg.exevhhg.exepid process 1008 vhhg.exe 1344 vhhg.exe -
Processes:
resource yara_rule behavioral1/memory/1696-63-0x0000000000430000-0x0000000000814000-memory.dmp upx behavioral1/memory/1696-67-0x0000000000430000-0x0000000000814000-memory.dmp upx behavioral1/memory/1696-66-0x0000000000430000-0x0000000000814000-memory.dmp upx behavioral1/memory/1696-70-0x0000000000430000-0x0000000000814000-memory.dmp upx behavioral1/memory/1696-72-0x0000000000430000-0x0000000000814000-memory.dmp upx behavioral1/memory/1696-75-0x0000000000430000-0x0000000000814000-memory.dmp upx behavioral1/memory/404-87-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/404-90-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/404-93-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/404-92-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/404-96-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/404-97-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/404-98-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/404-99-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
RegAsm.exeRegAsm.exepid process 1696 RegAsm.exe 1696 RegAsm.exe 1696 RegAsm.exe 1696 RegAsm.exe 1696 RegAsm.exe 404 RegAsm.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
D7M39A87SH3-ETRANSFER-RECEIPT.exevhhg.exedescription pid process target process PID 960 set thread context of 1696 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1008 set thread context of 404 1008 vhhg.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1900 schtasks.exe 1220 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RegAsm.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1696 RegAsm.exe Token: SeShutdownPrivilege 1696 RegAsm.exe Token: SeDebugPrivilege 404 RegAsm.exe Token: SeShutdownPrivilege 404 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 1696 RegAsm.exe 1696 RegAsm.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
D7M39A87SH3-ETRANSFER-RECEIPT.execmd.exetaskeng.exevhhg.execmd.exedescription pid process target process PID 960 wrote to memory of 2012 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 960 wrote to memory of 2012 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 960 wrote to memory of 2012 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 960 wrote to memory of 2012 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 2012 wrote to memory of 1900 2012 cmd.exe schtasks.exe PID 2012 wrote to memory of 1900 2012 cmd.exe schtasks.exe PID 2012 wrote to memory of 1900 2012 cmd.exe schtasks.exe PID 2012 wrote to memory of 1900 2012 cmd.exe schtasks.exe PID 960 wrote to memory of 1980 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 960 wrote to memory of 1980 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 960 wrote to memory of 1980 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 960 wrote to memory of 1980 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 960 wrote to memory of 1696 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 960 wrote to memory of 1696 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 960 wrote to memory of 1696 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 960 wrote to memory of 1696 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 960 wrote to memory of 1696 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 960 wrote to memory of 1696 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 960 wrote to memory of 1696 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 960 wrote to memory of 1696 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 960 wrote to memory of 1696 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 960 wrote to memory of 1696 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 960 wrote to memory of 1696 960 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1672 wrote to memory of 1008 1672 taskeng.exe vhhg.exe PID 1672 wrote to memory of 1008 1672 taskeng.exe vhhg.exe PID 1672 wrote to memory of 1008 1672 taskeng.exe vhhg.exe PID 1672 wrote to memory of 1008 1672 taskeng.exe vhhg.exe PID 1008 wrote to memory of 1504 1008 vhhg.exe cmd.exe PID 1008 wrote to memory of 1504 1008 vhhg.exe cmd.exe PID 1008 wrote to memory of 1504 1008 vhhg.exe cmd.exe PID 1008 wrote to memory of 1504 1008 vhhg.exe cmd.exe PID 1504 wrote to memory of 1220 1504 cmd.exe schtasks.exe PID 1504 wrote to memory of 1220 1504 cmd.exe schtasks.exe PID 1504 wrote to memory of 1220 1504 cmd.exe schtasks.exe PID 1504 wrote to memory of 1220 1504 cmd.exe schtasks.exe PID 1008 wrote to memory of 1212 1008 vhhg.exe cmd.exe PID 1008 wrote to memory of 1212 1008 vhhg.exe cmd.exe PID 1008 wrote to memory of 1212 1008 vhhg.exe cmd.exe PID 1008 wrote to memory of 1212 1008 vhhg.exe cmd.exe PID 1008 wrote to memory of 404 1008 vhhg.exe RegAsm.exe PID 1008 wrote to memory of 404 1008 vhhg.exe RegAsm.exe PID 1008 wrote to memory of 404 1008 vhhg.exe RegAsm.exe PID 1008 wrote to memory of 404 1008 vhhg.exe RegAsm.exe PID 1008 wrote to memory of 404 1008 vhhg.exe RegAsm.exe PID 1008 wrote to memory of 404 1008 vhhg.exe RegAsm.exe PID 1008 wrote to memory of 404 1008 vhhg.exe RegAsm.exe PID 1008 wrote to memory of 404 1008 vhhg.exe RegAsm.exe PID 1008 wrote to memory of 404 1008 vhhg.exe RegAsm.exe PID 1008 wrote to memory of 404 1008 vhhg.exe RegAsm.exe PID 1008 wrote to memory of 404 1008 vhhg.exe RegAsm.exe PID 1672 wrote to memory of 1344 1672 taskeng.exe vhhg.exe PID 1672 wrote to memory of 1344 1672 taskeng.exe vhhg.exe PID 1672 wrote to memory of 1344 1672 taskeng.exe vhhg.exe PID 1672 wrote to memory of 1344 1672 taskeng.exe vhhg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\D7M39A87SH3-ETRANSFER-RECEIPT.exe"C:\Users\Admin\AppData\Local\Temp\D7M39A87SH3-ETRANSFER-RECEIPT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\D7M39A87SH3-ETRANSFER-RECEIPT.exe" "C:\Users\Admin\AppData\Roaming\vhhg.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskeng.exetaskeng.exe {B2AA68CE-84A6-4977-9929-AF1A66E7C721} S-1-5-21-790309383-526510583-3802439154-1000:TVHJCWMH\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vhhg.exeC:\Users\Admin\AppData\Roaming\vhhg.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\vhhg.exe" "C:\Users\Admin\AppData\Roaming\vhhg.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\vhhg.exeC:\Users\Admin\AppData\Roaming\vhhg.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\vhhg.exeFilesize
300.0MB
MD5edd26deecff12183dc818957f18b866a
SHA17e4fc7d57f7502ad210ceafbe294716981585281
SHA2560b6306bc128b16b99cee0d04e4427bc0b5dbe32b2386fc4800cf42c9f42ed3b3
SHA512b86225d429f244077f1a4313318e034320da2091a02a8064065b2fbd290eaa5285adfe90a161886f6a13dcba996f536da6758da78cf54ec01c900369db841987
-
C:\Users\Admin\AppData\Roaming\vhhg.exeFilesize
300.0MB
MD5edd26deecff12183dc818957f18b866a
SHA17e4fc7d57f7502ad210ceafbe294716981585281
SHA2560b6306bc128b16b99cee0d04e4427bc0b5dbe32b2386fc4800cf42c9f42ed3b3
SHA512b86225d429f244077f1a4313318e034320da2091a02a8064065b2fbd290eaa5285adfe90a161886f6a13dcba996f536da6758da78cf54ec01c900369db841987
-
C:\Users\Admin\AppData\Roaming\vhhg.exeFilesize
300.0MB
MD5edd26deecff12183dc818957f18b866a
SHA17e4fc7d57f7502ad210ceafbe294716981585281
SHA2560b6306bc128b16b99cee0d04e4427bc0b5dbe32b2386fc4800cf42c9f42ed3b3
SHA512b86225d429f244077f1a4313318e034320da2091a02a8064065b2fbd290eaa5285adfe90a161886f6a13dcba996f536da6758da78cf54ec01c900369db841987
-
memory/404-90-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/404-91-0x00000000007E2730-mapping.dmp
-
memory/404-86-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/404-87-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/404-93-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/404-92-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/404-96-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/404-99-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/404-98-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/404-97-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/960-56-0x0000000005330000-0x00000000054A6000-memory.dmpFilesize
1.5MB
-
memory/960-54-0x0000000000220000-0x00000000003B2000-memory.dmpFilesize
1.6MB
-
memory/960-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmpFilesize
8KB
-
memory/1008-81-0x0000000000180000-0x0000000000312000-memory.dmpFilesize
1.6MB
-
memory/1008-79-0x0000000000000000-mapping.dmp
-
memory/1212-85-0x0000000000000000-mapping.dmp
-
memory/1220-84-0x0000000000000000-mapping.dmp
-
memory/1344-100-0x0000000000000000-mapping.dmp
-
memory/1344-102-0x00000000002F0000-0x0000000000482000-memory.dmpFilesize
1.6MB
-
memory/1504-83-0x0000000000000000-mapping.dmp
-
memory/1696-72-0x0000000000430000-0x0000000000814000-memory.dmpFilesize
3.9MB
-
memory/1696-74-0x0000000000160000-0x000000000016A000-memory.dmpFilesize
40KB
-
memory/1696-61-0x00000000006A2000-0x0000000000813000-memory.dmpFilesize
1.4MB
-
memory/1696-63-0x0000000000430000-0x0000000000814000-memory.dmpFilesize
3.9MB
-
memory/1696-77-0x0000000000160000-0x000000000016A000-memory.dmpFilesize
40KB
-
memory/1696-76-0x0000000000160000-0x000000000016A000-memory.dmpFilesize
40KB
-
memory/1696-75-0x0000000000430000-0x0000000000814000-memory.dmpFilesize
3.9MB
-
memory/1696-65-0x00000000007E2730-mapping.dmp
-
memory/1696-73-0x0000000000160000-0x000000000016A000-memory.dmpFilesize
40KB
-
memory/1696-67-0x0000000000430000-0x0000000000814000-memory.dmpFilesize
3.9MB
-
memory/1696-70-0x0000000000430000-0x0000000000814000-memory.dmpFilesize
3.9MB
-
memory/1696-66-0x0000000000430000-0x0000000000814000-memory.dmpFilesize
3.9MB
-
memory/1900-58-0x0000000000000000-mapping.dmp
-
memory/1980-59-0x0000000000000000-mapping.dmp
-
memory/2012-57-0x0000000000000000-mapping.dmp