Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17-06-2022 11:35
Static task
static1
Behavioral task
behavioral1
Sample
D7M39A87SH3-ETRANSFER-RECEIPT.exe
Resource
win7-20220414-en
General
-
Target
D7M39A87SH3-ETRANSFER-RECEIPT.exe
-
Size
300.0MB
-
MD5
edd26deecff12183dc818957f18b866a
-
SHA1
7e4fc7d57f7502ad210ceafbe294716981585281
-
SHA256
0b6306bc128b16b99cee0d04e4427bc0b5dbe32b2386fc4800cf42c9f42ed3b3
-
SHA512
b86225d429f244077f1a4313318e034320da2091a02a8064065b2fbd290eaa5285adfe90a161886f6a13dcba996f536da6758da78cf54ec01c900369db841987
Malware Config
Extracted
bitrat
1.38
bitrat9300.duckdns.org:9300
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Executes dropped EXE 2 IoCs
Processes:
vhhg.exevhhg.exepid process 2236 vhhg.exe 4452 vhhg.exe -
Processes:
resource yara_rule behavioral2/memory/2040-137-0x0000000000900000-0x0000000000CE4000-memory.dmp upx behavioral2/memory/2040-138-0x0000000000900000-0x0000000000CE4000-memory.dmp upx behavioral2/memory/2384-145-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2384-146-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2384-147-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2384-148-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2384-149-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2384-152-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
RegAsm.exepid process 2384 RegAsm.exe 2384 RegAsm.exe 2384 RegAsm.exe 2384 RegAsm.exe 2384 RegAsm.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
D7M39A87SH3-ETRANSFER-RECEIPT.exevhhg.exedescription pid process target process PID 1336 set thread context of 2040 1336 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 2236 set thread context of 2384 2236 vhhg.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2908 2040 WerFault.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2920 schtasks.exe 3688 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeShutdownPrivilege 2384 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 2384 RegAsm.exe 2384 RegAsm.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
D7M39A87SH3-ETRANSFER-RECEIPT.execmd.exevhhg.execmd.exedescription pid process target process PID 1336 wrote to memory of 1892 1336 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 1336 wrote to memory of 1892 1336 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 1336 wrote to memory of 1892 1336 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 1892 wrote to memory of 2920 1892 cmd.exe schtasks.exe PID 1892 wrote to memory of 2920 1892 cmd.exe schtasks.exe PID 1892 wrote to memory of 2920 1892 cmd.exe schtasks.exe PID 1336 wrote to memory of 5092 1336 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 1336 wrote to memory of 5092 1336 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 1336 wrote to memory of 5092 1336 D7M39A87SH3-ETRANSFER-RECEIPT.exe cmd.exe PID 1336 wrote to memory of 2040 1336 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1336 wrote to memory of 2040 1336 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1336 wrote to memory of 2040 1336 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1336 wrote to memory of 2040 1336 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1336 wrote to memory of 2040 1336 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1336 wrote to memory of 2040 1336 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 1336 wrote to memory of 2040 1336 D7M39A87SH3-ETRANSFER-RECEIPT.exe RegAsm.exe PID 2236 wrote to memory of 4000 2236 vhhg.exe cmd.exe PID 2236 wrote to memory of 4000 2236 vhhg.exe cmd.exe PID 2236 wrote to memory of 4000 2236 vhhg.exe cmd.exe PID 4000 wrote to memory of 3688 4000 cmd.exe schtasks.exe PID 4000 wrote to memory of 3688 4000 cmd.exe schtasks.exe PID 4000 wrote to memory of 3688 4000 cmd.exe schtasks.exe PID 2236 wrote to memory of 3108 2236 vhhg.exe cmd.exe PID 2236 wrote to memory of 3108 2236 vhhg.exe cmd.exe PID 2236 wrote to memory of 3108 2236 vhhg.exe cmd.exe PID 2236 wrote to memory of 2384 2236 vhhg.exe RegAsm.exe PID 2236 wrote to memory of 2384 2236 vhhg.exe RegAsm.exe PID 2236 wrote to memory of 2384 2236 vhhg.exe RegAsm.exe PID 2236 wrote to memory of 2384 2236 vhhg.exe RegAsm.exe PID 2236 wrote to memory of 2384 2236 vhhg.exe RegAsm.exe PID 2236 wrote to memory of 2384 2236 vhhg.exe RegAsm.exe PID 2236 wrote to memory of 2384 2236 vhhg.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\D7M39A87SH3-ETRANSFER-RECEIPT.exe"C:\Users\Admin\AppData\Local\Temp\D7M39A87SH3-ETRANSFER-RECEIPT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\D7M39A87SH3-ETRANSFER-RECEIPT.exe" "C:\Users\Admin\AppData\Roaming\vhhg.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 5723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2040 -ip 20401⤵
-
C:\Users\Admin\AppData\Roaming\vhhg.exeC:\Users\Admin\AppData\Roaming\vhhg.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\vhhg.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\vhhg.exe" "C:\Users\Admin\AppData\Roaming\vhhg.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\vhhg.exeC:\Users\Admin\AppData\Roaming\vhhg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vhhg.exe.logFilesize
520B
MD541c37de2b4598f7759f865817dba5f80
SHA1884ccf344bc2dd409425dc5ace0fd909a5f8cce4
SHA256427235491a8da3fc8770ed60d30af731835c94585cd08d4d81fca9f703b283bc
SHA512a8f3c74916623de100e4cf22e05df9cdf541b1e32443aab0434f35fb9c4a7fa950b997ce589b532e65731ae471a1f152cd5c00ea1df4bd7a6b57eb27c93c54bd
-
C:\Users\Admin\AppData\Roaming\vhhg.exeFilesize
300.0MB
MD5edd26deecff12183dc818957f18b866a
SHA17e4fc7d57f7502ad210ceafbe294716981585281
SHA2560b6306bc128b16b99cee0d04e4427bc0b5dbe32b2386fc4800cf42c9f42ed3b3
SHA512b86225d429f244077f1a4313318e034320da2091a02a8064065b2fbd290eaa5285adfe90a161886f6a13dcba996f536da6758da78cf54ec01c900369db841987
-
C:\Users\Admin\AppData\Roaming\vhhg.exeFilesize
300.0MB
MD5edd26deecff12183dc818957f18b866a
SHA17e4fc7d57f7502ad210ceafbe294716981585281
SHA2560b6306bc128b16b99cee0d04e4427bc0b5dbe32b2386fc4800cf42c9f42ed3b3
SHA512b86225d429f244077f1a4313318e034320da2091a02a8064065b2fbd290eaa5285adfe90a161886f6a13dcba996f536da6758da78cf54ec01c900369db841987
-
C:\Users\Admin\AppData\Roaming\vhhg.exeFilesize
300.0MB
MD5edd26deecff12183dc818957f18b866a
SHA17e4fc7d57f7502ad210ceafbe294716981585281
SHA2560b6306bc128b16b99cee0d04e4427bc0b5dbe32b2386fc4800cf42c9f42ed3b3
SHA512b86225d429f244077f1a4313318e034320da2091a02a8064065b2fbd290eaa5285adfe90a161886f6a13dcba996f536da6758da78cf54ec01c900369db841987
-
memory/1336-130-0x0000000000040000-0x00000000001D2000-memory.dmpFilesize
1.6MB
-
memory/1336-133-0x0000000005640000-0x0000000005BE4000-memory.dmpFilesize
5.6MB
-
memory/1892-131-0x0000000000000000-mapping.dmp
-
memory/2040-135-0x0000000000000000-mapping.dmp
-
memory/2040-137-0x0000000000900000-0x0000000000CE4000-memory.dmpFilesize
3.9MB
-
memory/2040-138-0x0000000000900000-0x0000000000CE4000-memory.dmpFilesize
3.9MB
-
memory/2384-149-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2384-148-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2384-152-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2384-144-0x0000000000000000-mapping.dmp
-
memory/2384-145-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2384-146-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2384-147-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2384-151-0x0000000074C20000-0x0000000074C59000-memory.dmpFilesize
228KB
-
memory/2384-150-0x0000000074880000-0x00000000748B9000-memory.dmpFilesize
228KB
-
memory/2920-132-0x0000000000000000-mapping.dmp
-
memory/3108-143-0x0000000000000000-mapping.dmp
-
memory/3688-142-0x0000000000000000-mapping.dmp
-
memory/4000-141-0x0000000000000000-mapping.dmp
-
memory/5092-134-0x0000000000000000-mapping.dmp