Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-06-2022 15:47
Static task
static1
Behavioral task
behavioral1
Sample
mrkbkdFdag.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
mrkbkdFdag.exe
Resource
win10-20220414-en
General
-
Target
mrkbkdFdag.exe
-
Size
1.6MB
-
MD5
cf6e51ffe0d98c19e74880e8ce170a9a
-
SHA1
2709d62f268d92c5d43aece4bd2089dace55c1ad
-
SHA256
23e10e6ce7df576f68283f2ceb00b0975170a3ef778161b35e3bbb578b4c7416
-
SHA512
25ff5c51aea16dc4f2ae5eb70f403eb2d386018297b86d0ccf4fe4dce6929d1409ae831c2721c404e9f58472873ce6e6b87a419b2355aee7fda7773366aab03a
Malware Config
Extracted
bitrat
1.38
bitrat9400.duckdns.org:9400
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
casr.execasr.exepid process 536 casr.exe 1980 casr.exe -
Processes:
resource yara_rule behavioral1/memory/880-61-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/880-63-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/880-64-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/880-67-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/880-66-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/880-70-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/880-71-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/880-72-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/880-75-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2032-98-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2032-99-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
RegAsm.exeRegAsm.exepid process 880 RegAsm.exe 880 RegAsm.exe 880 RegAsm.exe 880 RegAsm.exe 880 RegAsm.exe 2032 RegAsm.exe 880 RegAsm.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
mrkbkdFdag.execasr.exedescription pid process target process PID 1464 set thread context of 880 1464 mrkbkdFdag.exe RegAsm.exe PID 536 set thread context of 2032 536 casr.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RegAsm.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 880 RegAsm.exe Token: SeShutdownPrivilege 880 RegAsm.exe Token: SeDebugPrivilege 2032 RegAsm.exe Token: SeShutdownPrivilege 2032 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 880 RegAsm.exe 880 RegAsm.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
mrkbkdFdag.execmd.exetaskeng.execasr.execmd.exedescription pid process target process PID 1464 wrote to memory of 640 1464 mrkbkdFdag.exe cmd.exe PID 1464 wrote to memory of 640 1464 mrkbkdFdag.exe cmd.exe PID 1464 wrote to memory of 640 1464 mrkbkdFdag.exe cmd.exe PID 1464 wrote to memory of 640 1464 mrkbkdFdag.exe cmd.exe PID 640 wrote to memory of 316 640 cmd.exe schtasks.exe PID 640 wrote to memory of 316 640 cmd.exe schtasks.exe PID 640 wrote to memory of 316 640 cmd.exe schtasks.exe PID 640 wrote to memory of 316 640 cmd.exe schtasks.exe PID 1464 wrote to memory of 1804 1464 mrkbkdFdag.exe cmd.exe PID 1464 wrote to memory of 1804 1464 mrkbkdFdag.exe cmd.exe PID 1464 wrote to memory of 1804 1464 mrkbkdFdag.exe cmd.exe PID 1464 wrote to memory of 1804 1464 mrkbkdFdag.exe cmd.exe PID 1464 wrote to memory of 880 1464 mrkbkdFdag.exe RegAsm.exe PID 1464 wrote to memory of 880 1464 mrkbkdFdag.exe RegAsm.exe PID 1464 wrote to memory of 880 1464 mrkbkdFdag.exe RegAsm.exe PID 1464 wrote to memory of 880 1464 mrkbkdFdag.exe RegAsm.exe PID 1464 wrote to memory of 880 1464 mrkbkdFdag.exe RegAsm.exe PID 1464 wrote to memory of 880 1464 mrkbkdFdag.exe RegAsm.exe PID 1464 wrote to memory of 880 1464 mrkbkdFdag.exe RegAsm.exe PID 1464 wrote to memory of 880 1464 mrkbkdFdag.exe RegAsm.exe PID 1464 wrote to memory of 880 1464 mrkbkdFdag.exe RegAsm.exe PID 1464 wrote to memory of 880 1464 mrkbkdFdag.exe RegAsm.exe PID 1464 wrote to memory of 880 1464 mrkbkdFdag.exe RegAsm.exe PID 684 wrote to memory of 536 684 taskeng.exe casr.exe PID 684 wrote to memory of 536 684 taskeng.exe casr.exe PID 684 wrote to memory of 536 684 taskeng.exe casr.exe PID 684 wrote to memory of 536 684 taskeng.exe casr.exe PID 536 wrote to memory of 1952 536 casr.exe cmd.exe PID 536 wrote to memory of 1952 536 casr.exe cmd.exe PID 536 wrote to memory of 1952 536 casr.exe cmd.exe PID 536 wrote to memory of 1952 536 casr.exe cmd.exe PID 1952 wrote to memory of 1792 1952 cmd.exe schtasks.exe PID 1952 wrote to memory of 1792 1952 cmd.exe schtasks.exe PID 1952 wrote to memory of 1792 1952 cmd.exe schtasks.exe PID 1952 wrote to memory of 1792 1952 cmd.exe schtasks.exe PID 536 wrote to memory of 560 536 casr.exe cmd.exe PID 536 wrote to memory of 560 536 casr.exe cmd.exe PID 536 wrote to memory of 560 536 casr.exe cmd.exe PID 536 wrote to memory of 560 536 casr.exe cmd.exe PID 536 wrote to memory of 2032 536 casr.exe RegAsm.exe PID 536 wrote to memory of 2032 536 casr.exe RegAsm.exe PID 536 wrote to memory of 2032 536 casr.exe RegAsm.exe PID 536 wrote to memory of 2032 536 casr.exe RegAsm.exe PID 536 wrote to memory of 2032 536 casr.exe RegAsm.exe PID 536 wrote to memory of 2032 536 casr.exe RegAsm.exe PID 536 wrote to memory of 2032 536 casr.exe RegAsm.exe PID 536 wrote to memory of 2032 536 casr.exe RegAsm.exe PID 536 wrote to memory of 2032 536 casr.exe RegAsm.exe PID 536 wrote to memory of 2032 536 casr.exe RegAsm.exe PID 536 wrote to memory of 2032 536 casr.exe RegAsm.exe PID 684 wrote to memory of 1980 684 taskeng.exe casr.exe PID 684 wrote to memory of 1980 684 taskeng.exe casr.exe PID 684 wrote to memory of 1980 684 taskeng.exe casr.exe PID 684 wrote to memory of 1980 684 taskeng.exe casr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mrkbkdFdag.exe"C:\Users\Admin\AppData\Local\Temp\mrkbkdFdag.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\casr.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\casr.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\mrkbkdFdag.exe" "C:\Users\Admin\AppData\Roaming\casr.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskeng.exetaskeng.exe {2179B07D-C19B-47CC-B64B-9FAF373AB4FA} S-1-5-21-1083475884-596052423-1669053738-1000:WYZSGDWS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\casr.exeC:\Users\Admin\AppData\Roaming\casr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\casr.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\casr.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\casr.exe" "C:\Users\Admin\AppData\Roaming\casr.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\casr.exeC:\Users\Admin\AppData\Roaming\casr.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\casr.exeFilesize
1.6MB
MD5cf6e51ffe0d98c19e74880e8ce170a9a
SHA12709d62f268d92c5d43aece4bd2089dace55c1ad
SHA25623e10e6ce7df576f68283f2ceb00b0975170a3ef778161b35e3bbb578b4c7416
SHA51225ff5c51aea16dc4f2ae5eb70f403eb2d386018297b86d0ccf4fe4dce6929d1409ae831c2721c404e9f58472873ce6e6b87a419b2355aee7fda7773366aab03a
-
C:\Users\Admin\AppData\Roaming\casr.exeFilesize
1.6MB
MD5cf6e51ffe0d98c19e74880e8ce170a9a
SHA12709d62f268d92c5d43aece4bd2089dace55c1ad
SHA25623e10e6ce7df576f68283f2ceb00b0975170a3ef778161b35e3bbb578b4c7416
SHA51225ff5c51aea16dc4f2ae5eb70f403eb2d386018297b86d0ccf4fe4dce6929d1409ae831c2721c404e9f58472873ce6e6b87a419b2355aee7fda7773366aab03a
-
C:\Users\Admin\AppData\Roaming\casr.exeFilesize
1.6MB
MD5cf6e51ffe0d98c19e74880e8ce170a9a
SHA12709d62f268d92c5d43aece4bd2089dace55c1ad
SHA25623e10e6ce7df576f68283f2ceb00b0975170a3ef778161b35e3bbb578b4c7416
SHA51225ff5c51aea16dc4f2ae5eb70f403eb2d386018297b86d0ccf4fe4dce6929d1409ae831c2721c404e9f58472873ce6e6b87a419b2355aee7fda7773366aab03a
-
memory/316-58-0x0000000000000000-mapping.dmp
-
memory/536-81-0x0000000001160000-0x00000000012F4000-memory.dmpFilesize
1.6MB
-
memory/536-79-0x0000000000000000-mapping.dmp
-
memory/560-85-0x0000000000000000-mapping.dmp
-
memory/640-57-0x0000000000000000-mapping.dmp
-
memory/880-64-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/880-60-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/880-65-0x00000000007E2740-mapping.dmp
-
memory/880-67-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/880-66-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/880-70-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/880-71-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/880-72-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/880-73-0x0000000000120000-0x000000000012A000-memory.dmpFilesize
40KB
-
memory/880-74-0x0000000000120000-0x000000000012A000-memory.dmpFilesize
40KB
-
memory/880-75-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/880-76-0x0000000000120000-0x000000000012A000-memory.dmpFilesize
40KB
-
memory/880-77-0x0000000000120000-0x000000000012A000-memory.dmpFilesize
40KB
-
memory/880-63-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/880-61-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/880-107-0x0000000000120000-0x000000000012A000-memory.dmpFilesize
40KB
-
memory/880-106-0x0000000000120000-0x000000000012A000-memory.dmpFilesize
40KB
-
memory/880-101-0x0000000000120000-0x000000000012A000-memory.dmpFilesize
40KB
-
memory/880-100-0x0000000000120000-0x000000000012A000-memory.dmpFilesize
40KB
-
memory/1464-56-0x00000000055C0000-0x0000000005736000-memory.dmpFilesize
1.5MB
-
memory/1464-55-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/1464-54-0x0000000000D40000-0x0000000000ED4000-memory.dmpFilesize
1.6MB
-
memory/1792-84-0x0000000000000000-mapping.dmp
-
memory/1804-59-0x0000000000000000-mapping.dmp
-
memory/1952-83-0x0000000000000000-mapping.dmp
-
memory/1980-102-0x0000000000000000-mapping.dmp
-
memory/1980-104-0x0000000000240000-0x00000000003D4000-memory.dmpFilesize
1.6MB
-
memory/2032-91-0x00000000007E2740-mapping.dmp
-
memory/2032-98-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2032-99-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB