Analysis
-
max time kernel
160s -
max time network
165s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
22-06-2022 15:41
Static task
static1
Behavioral task
behavioral1
Sample
fxdgf.exe
Resource
win7-20220414-en
General
-
Target
fxdgf.exe
-
Size
1.7MB
-
MD5
6505bd7c5e3775f45522cead41f38882
-
SHA1
c13140dc82455007a70c7747b4f6aaee5e549315
-
SHA256
c8e1ce5d1216e1e068af5fc38b107b78f32372f69d59b4f1e6a456770ded8744
-
SHA512
96998ce4683585d2913d3526bbdc48180fc373feb6e02320fff948284a4aeea9136886a2a8ffc5574c9b0651f8ce239ec81be717a9ed163f9e2442b70587ec5e
Malware Config
Extracted
bitrat
1.38
bitrat9300.duckdns.org:9300
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Executes dropped EXE 2 IoCs
Processes:
fxdgf.exefxdgf.exepid process 1004 fxdgf.exe 952 fxdgf.exe -
Processes:
resource yara_rule behavioral1/memory/476-60-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/476-62-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/476-63-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/476-65-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/476-66-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/476-69-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/476-70-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/476-71-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/476-74-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/872-97-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/872-98-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
RegAsm.exeRegAsm.exepid process 476 RegAsm.exe 476 RegAsm.exe 476 RegAsm.exe 476 RegAsm.exe 476 RegAsm.exe 872 RegAsm.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
fxdgf.exefxdgf.exedescription pid process target process PID 1664 set thread context of 476 1664 fxdgf.exe RegAsm.exe PID 1004 set thread context of 872 1004 fxdgf.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1392 schtasks.exe 1420 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RegAsm.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 476 RegAsm.exe Token: SeShutdownPrivilege 476 RegAsm.exe Token: SeDebugPrivilege 872 RegAsm.exe Token: SeShutdownPrivilege 872 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 476 RegAsm.exe 476 RegAsm.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
fxdgf.execmd.exetaskeng.exefxdgf.execmd.exedescription pid process target process PID 1664 wrote to memory of 1788 1664 fxdgf.exe cmd.exe PID 1664 wrote to memory of 1788 1664 fxdgf.exe cmd.exe PID 1664 wrote to memory of 1788 1664 fxdgf.exe cmd.exe PID 1664 wrote to memory of 1788 1664 fxdgf.exe cmd.exe PID 1788 wrote to memory of 1392 1788 cmd.exe schtasks.exe PID 1788 wrote to memory of 1392 1788 cmd.exe schtasks.exe PID 1788 wrote to memory of 1392 1788 cmd.exe schtasks.exe PID 1788 wrote to memory of 1392 1788 cmd.exe schtasks.exe PID 1664 wrote to memory of 2016 1664 fxdgf.exe cmd.exe PID 1664 wrote to memory of 2016 1664 fxdgf.exe cmd.exe PID 1664 wrote to memory of 2016 1664 fxdgf.exe cmd.exe PID 1664 wrote to memory of 2016 1664 fxdgf.exe cmd.exe PID 1664 wrote to memory of 476 1664 fxdgf.exe RegAsm.exe PID 1664 wrote to memory of 476 1664 fxdgf.exe RegAsm.exe PID 1664 wrote to memory of 476 1664 fxdgf.exe RegAsm.exe PID 1664 wrote to memory of 476 1664 fxdgf.exe RegAsm.exe PID 1664 wrote to memory of 476 1664 fxdgf.exe RegAsm.exe PID 1664 wrote to memory of 476 1664 fxdgf.exe RegAsm.exe PID 1664 wrote to memory of 476 1664 fxdgf.exe RegAsm.exe PID 1664 wrote to memory of 476 1664 fxdgf.exe RegAsm.exe PID 1664 wrote to memory of 476 1664 fxdgf.exe RegAsm.exe PID 1664 wrote to memory of 476 1664 fxdgf.exe RegAsm.exe PID 1664 wrote to memory of 476 1664 fxdgf.exe RegAsm.exe PID 1156 wrote to memory of 1004 1156 taskeng.exe fxdgf.exe PID 1156 wrote to memory of 1004 1156 taskeng.exe fxdgf.exe PID 1156 wrote to memory of 1004 1156 taskeng.exe fxdgf.exe PID 1156 wrote to memory of 1004 1156 taskeng.exe fxdgf.exe PID 1004 wrote to memory of 1380 1004 fxdgf.exe cmd.exe PID 1004 wrote to memory of 1380 1004 fxdgf.exe cmd.exe PID 1004 wrote to memory of 1380 1004 fxdgf.exe cmd.exe PID 1004 wrote to memory of 1380 1004 fxdgf.exe cmd.exe PID 1380 wrote to memory of 1420 1380 cmd.exe schtasks.exe PID 1380 wrote to memory of 1420 1380 cmd.exe schtasks.exe PID 1380 wrote to memory of 1420 1380 cmd.exe schtasks.exe PID 1380 wrote to memory of 1420 1380 cmd.exe schtasks.exe PID 1004 wrote to memory of 988 1004 fxdgf.exe cmd.exe PID 1004 wrote to memory of 988 1004 fxdgf.exe cmd.exe PID 1004 wrote to memory of 988 1004 fxdgf.exe cmd.exe PID 1004 wrote to memory of 988 1004 fxdgf.exe cmd.exe PID 1004 wrote to memory of 872 1004 fxdgf.exe RegAsm.exe PID 1004 wrote to memory of 872 1004 fxdgf.exe RegAsm.exe PID 1004 wrote to memory of 872 1004 fxdgf.exe RegAsm.exe PID 1004 wrote to memory of 872 1004 fxdgf.exe RegAsm.exe PID 1004 wrote to memory of 872 1004 fxdgf.exe RegAsm.exe PID 1004 wrote to memory of 872 1004 fxdgf.exe RegAsm.exe PID 1004 wrote to memory of 872 1004 fxdgf.exe RegAsm.exe PID 1004 wrote to memory of 872 1004 fxdgf.exe RegAsm.exe PID 1004 wrote to memory of 872 1004 fxdgf.exe RegAsm.exe PID 1004 wrote to memory of 872 1004 fxdgf.exe RegAsm.exe PID 1004 wrote to memory of 872 1004 fxdgf.exe RegAsm.exe PID 1156 wrote to memory of 952 1156 taskeng.exe fxdgf.exe PID 1156 wrote to memory of 952 1156 taskeng.exe fxdgf.exe PID 1156 wrote to memory of 952 1156 taskeng.exe fxdgf.exe PID 1156 wrote to memory of 952 1156 taskeng.exe fxdgf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fxdgf.exe"C:\Users\Admin\AppData\Local\Temp\fxdgf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\fxdgf.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\fxdgf.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\fxdgf.exe" "C:\Users\Admin\AppData\Roaming\fxdgf.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskeng.exetaskeng.exe {FD706D68-220E-4173-AF1D-D614C512A891} S-1-5-21-1819626980-2277161760-1023733287-1000:TBHNEBSE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\fxdgf.exeC:\Users\Admin\AppData\Roaming\fxdgf.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\fxdgf.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\fxdgf.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\fxdgf.exe" "C:\Users\Admin\AppData\Roaming\fxdgf.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\fxdgf.exeC:\Users\Admin\AppData\Roaming\fxdgf.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\fxdgf.exeFilesize
1.7MB
MD56505bd7c5e3775f45522cead41f38882
SHA1c13140dc82455007a70c7747b4f6aaee5e549315
SHA256c8e1ce5d1216e1e068af5fc38b107b78f32372f69d59b4f1e6a456770ded8744
SHA51296998ce4683585d2913d3526bbdc48180fc373feb6e02320fff948284a4aeea9136886a2a8ffc5574c9b0651f8ce239ec81be717a9ed163f9e2442b70587ec5e
-
C:\Users\Admin\AppData\Roaming\fxdgf.exeFilesize
1.7MB
MD56505bd7c5e3775f45522cead41f38882
SHA1c13140dc82455007a70c7747b4f6aaee5e549315
SHA256c8e1ce5d1216e1e068af5fc38b107b78f32372f69d59b4f1e6a456770ded8744
SHA51296998ce4683585d2913d3526bbdc48180fc373feb6e02320fff948284a4aeea9136886a2a8ffc5574c9b0651f8ce239ec81be717a9ed163f9e2442b70587ec5e
-
C:\Users\Admin\AppData\Roaming\fxdgf.exeFilesize
1.7MB
MD56505bd7c5e3775f45522cead41f38882
SHA1c13140dc82455007a70c7747b4f6aaee5e549315
SHA256c8e1ce5d1216e1e068af5fc38b107b78f32372f69d59b4f1e6a456770ded8744
SHA51296998ce4683585d2913d3526bbdc48180fc373feb6e02320fff948284a4aeea9136886a2a8ffc5574c9b0651f8ce239ec81be717a9ed163f9e2442b70587ec5e
-
memory/476-73-0x00000000000B0000-0x00000000000BA000-memory.dmpFilesize
40KB
-
memory/476-59-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/476-75-0x00000000000B0000-0x00000000000BA000-memory.dmpFilesize
40KB
-
memory/476-60-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/476-62-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/476-63-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/476-64-0x00000000007E2730-mapping.dmp
-
memory/476-65-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/476-66-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/476-69-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/476-70-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/476-71-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/476-72-0x00000000000B0000-0x00000000000BA000-memory.dmpFilesize
40KB
-
memory/476-74-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/476-76-0x00000000000B0000-0x00000000000BA000-memory.dmpFilesize
40KB
-
memory/872-98-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/872-97-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/872-90-0x00000000007E2730-mapping.dmp
-
memory/952-101-0x00000000012F0000-0x000000000149E000-memory.dmpFilesize
1.7MB
-
memory/952-99-0x0000000000000000-mapping.dmp
-
memory/988-84-0x0000000000000000-mapping.dmp
-
memory/1004-80-0x0000000000D70000-0x0000000000F1E000-memory.dmpFilesize
1.7MB
-
memory/1004-78-0x0000000000000000-mapping.dmp
-
memory/1380-82-0x0000000000000000-mapping.dmp
-
memory/1392-57-0x0000000000000000-mapping.dmp
-
memory/1420-83-0x0000000000000000-mapping.dmp
-
memory/1664-55-0x0000000074E91000-0x0000000074E93000-memory.dmpFilesize
8KB
-
memory/1664-54-0x0000000000EA0000-0x000000000104E000-memory.dmpFilesize
1.7MB
-
memory/1788-56-0x0000000000000000-mapping.dmp
-
memory/2016-58-0x0000000000000000-mapping.dmp