Analysis
-
max time kernel
194s -
max time network
205s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
22-06-2022 15:41
Static task
static1
Behavioral task
behavioral1
Sample
fxdgf.exe
Resource
win7-20220414-en
General
-
Target
fxdgf.exe
-
Size
1.7MB
-
MD5
6505bd7c5e3775f45522cead41f38882
-
SHA1
c13140dc82455007a70c7747b4f6aaee5e549315
-
SHA256
c8e1ce5d1216e1e068af5fc38b107b78f32372f69d59b4f1e6a456770ded8744
-
SHA512
96998ce4683585d2913d3526bbdc48180fc373feb6e02320fff948284a4aeea9136886a2a8ffc5574c9b0651f8ce239ec81be717a9ed163f9e2442b70587ec5e
Malware Config
Extracted
bitrat
1.38
bitrat9300.duckdns.org:9300
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Executes dropped EXE 2 IoCs
Processes:
fxdgf.exefxdgf.exepid process 1820 fxdgf.exe 1172 fxdgf.exe -
Processes:
resource yara_rule behavioral2/memory/1560-249-0x0000000000B00000-0x0000000000EE4000-memory.dmp upx behavioral2/memory/3008-379-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3008-442-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
RegAsm.exepid process 3008 RegAsm.exe 3008 RegAsm.exe 3008 RegAsm.exe 3008 RegAsm.exe 3008 RegAsm.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
fxdgf.exefxdgf.exedescription pid process target process PID 704 set thread context of 1560 704 fxdgf.exe RegAsm.exe PID 1820 set thread context of 3008 1820 fxdgf.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1040 1560 WerFault.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3812 schtasks.exe 2240 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeShutdownPrivilege 3008 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 3008 RegAsm.exe 3008 RegAsm.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
fxdgf.execmd.exefxdgf.execmd.exedescription pid process target process PID 704 wrote to memory of 2624 704 fxdgf.exe cmd.exe PID 704 wrote to memory of 2624 704 fxdgf.exe cmd.exe PID 704 wrote to memory of 2624 704 fxdgf.exe cmd.exe PID 2624 wrote to memory of 3812 2624 cmd.exe schtasks.exe PID 2624 wrote to memory of 3812 2624 cmd.exe schtasks.exe PID 2624 wrote to memory of 3812 2624 cmd.exe schtasks.exe PID 704 wrote to memory of 1532 704 fxdgf.exe cmd.exe PID 704 wrote to memory of 1532 704 fxdgf.exe cmd.exe PID 704 wrote to memory of 1532 704 fxdgf.exe cmd.exe PID 704 wrote to memory of 1560 704 fxdgf.exe RegAsm.exe PID 704 wrote to memory of 1560 704 fxdgf.exe RegAsm.exe PID 704 wrote to memory of 1560 704 fxdgf.exe RegAsm.exe PID 704 wrote to memory of 1560 704 fxdgf.exe RegAsm.exe PID 704 wrote to memory of 1560 704 fxdgf.exe RegAsm.exe PID 704 wrote to memory of 1560 704 fxdgf.exe RegAsm.exe PID 704 wrote to memory of 1560 704 fxdgf.exe RegAsm.exe PID 1820 wrote to memory of 3924 1820 fxdgf.exe cmd.exe PID 1820 wrote to memory of 3924 1820 fxdgf.exe cmd.exe PID 1820 wrote to memory of 3924 1820 fxdgf.exe cmd.exe PID 3924 wrote to memory of 2240 3924 cmd.exe schtasks.exe PID 3924 wrote to memory of 2240 3924 cmd.exe schtasks.exe PID 3924 wrote to memory of 2240 3924 cmd.exe schtasks.exe PID 1820 wrote to memory of 2704 1820 fxdgf.exe cmd.exe PID 1820 wrote to memory of 2704 1820 fxdgf.exe cmd.exe PID 1820 wrote to memory of 2704 1820 fxdgf.exe cmd.exe PID 1820 wrote to memory of 3008 1820 fxdgf.exe RegAsm.exe PID 1820 wrote to memory of 3008 1820 fxdgf.exe RegAsm.exe PID 1820 wrote to memory of 3008 1820 fxdgf.exe RegAsm.exe PID 1820 wrote to memory of 3008 1820 fxdgf.exe RegAsm.exe PID 1820 wrote to memory of 3008 1820 fxdgf.exe RegAsm.exe PID 1820 wrote to memory of 3008 1820 fxdgf.exe RegAsm.exe PID 1820 wrote to memory of 3008 1820 fxdgf.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fxdgf.exe"C:\Users\Admin\AppData\Local\Temp\fxdgf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\fxdgf.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\fxdgf.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\fxdgf.exe" "C:\Users\Admin\AppData\Roaming\fxdgf.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 5683⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\fxdgf.exeC:\Users\Admin\AppData\Roaming\fxdgf.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\fxdgf.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\fxdgf.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\fxdgf.exe" "C:\Users\Admin\AppData\Roaming\fxdgf.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\fxdgf.exeC:\Users\Admin\AppData\Roaming\fxdgf.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fxdgf.exe.logFilesize
805B
MD54665cf8a9a71b273050bd4636040ee7c
SHA13993526de306ba22b6cf07496f391b63dc22d4e5
SHA2566ac546cb6c1c85c2ff0c8ad1104aeb5b7f484e4b1fbb32eb4806fadcb96de298
SHA512638c77d55c5e6db0b53728227235027fe572ca1e51f35ce1b047910db336d53139cb691a35a41b37c1614dd816e502c76b8bbf605d9b905b254bddc8dad4377e
-
C:\Users\Admin\AppData\Roaming\fxdgf.exeFilesize
1.7MB
MD56505bd7c5e3775f45522cead41f38882
SHA1c13140dc82455007a70c7747b4f6aaee5e549315
SHA256c8e1ce5d1216e1e068af5fc38b107b78f32372f69d59b4f1e6a456770ded8744
SHA51296998ce4683585d2913d3526bbdc48180fc373feb6e02320fff948284a4aeea9136886a2a8ffc5574c9b0651f8ce239ec81be717a9ed163f9e2442b70587ec5e
-
C:\Users\Admin\AppData\Roaming\fxdgf.exeFilesize
1.7MB
MD56505bd7c5e3775f45522cead41f38882
SHA1c13140dc82455007a70c7747b4f6aaee5e549315
SHA256c8e1ce5d1216e1e068af5fc38b107b78f32372f69d59b4f1e6a456770ded8744
SHA51296998ce4683585d2913d3526bbdc48180fc373feb6e02320fff948284a4aeea9136886a2a8ffc5574c9b0651f8ce239ec81be717a9ed163f9e2442b70587ec5e
-
C:\Users\Admin\AppData\Roaming\fxdgf.exeFilesize
1.7MB
MD56505bd7c5e3775f45522cead41f38882
SHA1c13140dc82455007a70c7747b4f6aaee5e549315
SHA256c8e1ce5d1216e1e068af5fc38b107b78f32372f69d59b4f1e6a456770ded8744
SHA51296998ce4683585d2913d3526bbdc48180fc373feb6e02320fff948284a4aeea9136886a2a8ffc5574c9b0651f8ce239ec81be717a9ed163f9e2442b70587ec5e
-
memory/704-156-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-118-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-120-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-121-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-122-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-123-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-124-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-125-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-127-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-126-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-128-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-129-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-130-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-131-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-132-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-133-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-134-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-135-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-136-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-137-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-139-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-138-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-140-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-142-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-141-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-144-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-143-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-145-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-146-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-147-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-148-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-150-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-149-0x0000000000220000-0x00000000003CE000-memory.dmpFilesize
1.7MB
-
memory/704-151-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-152-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-153-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-154-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-155-0x00000000050B0000-0x00000000055AE000-memory.dmpFilesize
5.0MB
-
memory/704-162-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-116-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-119-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-159-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-160-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-161-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-158-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-163-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-164-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-165-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/704-157-0x0000000004C50000-0x0000000004CE2000-memory.dmpFilesize
584KB
-
memory/704-117-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1532-191-0x0000000000000000-mapping.dmp
-
memory/1560-249-0x0000000000B00000-0x0000000000EE4000-memory.dmpFilesize
3.9MB
-
memory/1560-206-0x00000000007E2730-mapping.dmp
-
memory/2240-308-0x0000000000000000-mapping.dmp
-
memory/2624-169-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/2624-170-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/2624-171-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/2624-168-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/2624-166-0x0000000000000000-mapping.dmp
-
memory/2624-167-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/2704-327-0x0000000000000000-mapping.dmp
-
memory/3008-441-0x0000000072C30000-0x0000000072C6A000-memory.dmpFilesize
232KB
-
memory/3008-394-0x0000000072CA0000-0x0000000072CDA000-memory.dmpFilesize
232KB
-
memory/3008-379-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3008-334-0x00000000007E2730-mapping.dmp
-
memory/3008-442-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3812-182-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/3812-176-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/3812-181-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/3812-184-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/3812-183-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/3812-179-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/3812-177-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/3812-180-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/3812-175-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/3812-174-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/3812-173-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/3812-172-0x0000000000000000-mapping.dmp
-
memory/3812-178-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/3924-302-0x0000000000000000-mapping.dmp