Analysis
-
max time kernel
229s -
max time network
246s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
22-06-2022 15:43
Static task
static1
Behavioral task
behavioral1
Sample
fxdgf.exe
Resource
win7-20220414-en
General
-
Target
fxdgf.exe
-
Size
1.7MB
-
MD5
6505bd7c5e3775f45522cead41f38882
-
SHA1
c13140dc82455007a70c7747b4f6aaee5e549315
-
SHA256
c8e1ce5d1216e1e068af5fc38b107b78f32372f69d59b4f1e6a456770ded8744
-
SHA512
96998ce4683585d2913d3526bbdc48180fc373feb6e02320fff948284a4aeea9136886a2a8ffc5574c9b0651f8ce239ec81be717a9ed163f9e2442b70587ec5e
Malware Config
Extracted
bitrat
1.38
bitrat9300.duckdns.org:9300
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Executes dropped EXE 1 IoCs
Processes:
fxdgf.exepid process 1452 fxdgf.exe -
Processes:
resource yara_rule behavioral1/memory/1912-60-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1912-62-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1912-63-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1912-66-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1912-65-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1912-69-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1912-70-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1912-71-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1912-74-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1600-92-0x00000000004C0000-0x00000000008A4000-memory.dmp upx behavioral1/memory/1600-91-0x00000000004C0000-0x00000000008A4000-memory.dmp upx behavioral1/memory/1600-95-0x00000000004C0000-0x00000000008A4000-memory.dmp upx behavioral1/memory/1600-97-0x00000000004C0000-0x00000000008A4000-memory.dmp upx behavioral1/memory/1600-98-0x00000000004C0000-0x00000000008A4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
RegAsm.exeRegAsm.exepid process 1912 RegAsm.exe 1912 RegAsm.exe 1912 RegAsm.exe 1912 RegAsm.exe 1912 RegAsm.exe 1600 RegAsm.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
fxdgf.exefxdgf.exedescription pid process target process PID 1296 set thread context of 1912 1296 fxdgf.exe RegAsm.exe PID 1452 set thread context of 1600 1452 fxdgf.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RegAsm.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1912 RegAsm.exe Token: SeShutdownPrivilege 1912 RegAsm.exe Token: SeDebugPrivilege 1600 RegAsm.exe Token: SeShutdownPrivilege 1600 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 1912 RegAsm.exe 1912 RegAsm.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
fxdgf.execmd.exetaskeng.exefxdgf.execmd.exedescription pid process target process PID 1296 wrote to memory of 2028 1296 fxdgf.exe cmd.exe PID 1296 wrote to memory of 2028 1296 fxdgf.exe cmd.exe PID 1296 wrote to memory of 2028 1296 fxdgf.exe cmd.exe PID 1296 wrote to memory of 2028 1296 fxdgf.exe cmd.exe PID 2028 wrote to memory of 932 2028 cmd.exe schtasks.exe PID 2028 wrote to memory of 932 2028 cmd.exe schtasks.exe PID 2028 wrote to memory of 932 2028 cmd.exe schtasks.exe PID 2028 wrote to memory of 932 2028 cmd.exe schtasks.exe PID 1296 wrote to memory of 1164 1296 fxdgf.exe cmd.exe PID 1296 wrote to memory of 1164 1296 fxdgf.exe cmd.exe PID 1296 wrote to memory of 1164 1296 fxdgf.exe cmd.exe PID 1296 wrote to memory of 1164 1296 fxdgf.exe cmd.exe PID 1296 wrote to memory of 1912 1296 fxdgf.exe RegAsm.exe PID 1296 wrote to memory of 1912 1296 fxdgf.exe RegAsm.exe PID 1296 wrote to memory of 1912 1296 fxdgf.exe RegAsm.exe PID 1296 wrote to memory of 1912 1296 fxdgf.exe RegAsm.exe PID 1296 wrote to memory of 1912 1296 fxdgf.exe RegAsm.exe PID 1296 wrote to memory of 1912 1296 fxdgf.exe RegAsm.exe PID 1296 wrote to memory of 1912 1296 fxdgf.exe RegAsm.exe PID 1296 wrote to memory of 1912 1296 fxdgf.exe RegAsm.exe PID 1296 wrote to memory of 1912 1296 fxdgf.exe RegAsm.exe PID 1296 wrote to memory of 1912 1296 fxdgf.exe RegAsm.exe PID 1296 wrote to memory of 1912 1296 fxdgf.exe RegAsm.exe PID 1624 wrote to memory of 1452 1624 taskeng.exe fxdgf.exe PID 1624 wrote to memory of 1452 1624 taskeng.exe fxdgf.exe PID 1624 wrote to memory of 1452 1624 taskeng.exe fxdgf.exe PID 1624 wrote to memory of 1452 1624 taskeng.exe fxdgf.exe PID 1452 wrote to memory of 1996 1452 fxdgf.exe cmd.exe PID 1452 wrote to memory of 1996 1452 fxdgf.exe cmd.exe PID 1452 wrote to memory of 1996 1452 fxdgf.exe cmd.exe PID 1452 wrote to memory of 1996 1452 fxdgf.exe cmd.exe PID 1996 wrote to memory of 516 1996 cmd.exe schtasks.exe PID 1996 wrote to memory of 516 1996 cmd.exe schtasks.exe PID 1996 wrote to memory of 516 1996 cmd.exe schtasks.exe PID 1996 wrote to memory of 516 1996 cmd.exe schtasks.exe PID 1452 wrote to memory of 880 1452 fxdgf.exe cmd.exe PID 1452 wrote to memory of 880 1452 fxdgf.exe cmd.exe PID 1452 wrote to memory of 880 1452 fxdgf.exe cmd.exe PID 1452 wrote to memory of 880 1452 fxdgf.exe cmd.exe PID 1452 wrote to memory of 1600 1452 fxdgf.exe RegAsm.exe PID 1452 wrote to memory of 1600 1452 fxdgf.exe RegAsm.exe PID 1452 wrote to memory of 1600 1452 fxdgf.exe RegAsm.exe PID 1452 wrote to memory of 1600 1452 fxdgf.exe RegAsm.exe PID 1452 wrote to memory of 1600 1452 fxdgf.exe RegAsm.exe PID 1452 wrote to memory of 1600 1452 fxdgf.exe RegAsm.exe PID 1452 wrote to memory of 1600 1452 fxdgf.exe RegAsm.exe PID 1452 wrote to memory of 1600 1452 fxdgf.exe RegAsm.exe PID 1452 wrote to memory of 1600 1452 fxdgf.exe RegAsm.exe PID 1452 wrote to memory of 1600 1452 fxdgf.exe RegAsm.exe PID 1452 wrote to memory of 1600 1452 fxdgf.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fxdgf.exe"C:\Users\Admin\AppData\Local\Temp\fxdgf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\fxdgf.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\fxdgf.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\fxdgf.exe" "C:\Users\Admin\AppData\Roaming\fxdgf.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskeng.exetaskeng.exe {E24AD97B-486C-494A-A76C-E7B28D1731AD} S-1-5-21-1083475884-596052423-1669053738-1000:WYZSGDWS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\fxdgf.exeC:\Users\Admin\AppData\Roaming\fxdgf.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\fxdgf.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\fxdgf.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\fxdgf.exe" "C:\Users\Admin\AppData\Roaming\fxdgf.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\fxdgf.exeFilesize
1.7MB
MD56505bd7c5e3775f45522cead41f38882
SHA1c13140dc82455007a70c7747b4f6aaee5e549315
SHA256c8e1ce5d1216e1e068af5fc38b107b78f32372f69d59b4f1e6a456770ded8744
SHA51296998ce4683585d2913d3526bbdc48180fc373feb6e02320fff948284a4aeea9136886a2a8ffc5574c9b0651f8ce239ec81be717a9ed163f9e2442b70587ec5e
-
C:\Users\Admin\AppData\Roaming\fxdgf.exeFilesize
1.7MB
MD56505bd7c5e3775f45522cead41f38882
SHA1c13140dc82455007a70c7747b4f6aaee5e549315
SHA256c8e1ce5d1216e1e068af5fc38b107b78f32372f69d59b4f1e6a456770ded8744
SHA51296998ce4683585d2913d3526bbdc48180fc373feb6e02320fff948284a4aeea9136886a2a8ffc5574c9b0651f8ce239ec81be717a9ed163f9e2442b70587ec5e
-
memory/516-83-0x0000000000000000-mapping.dmp
-
memory/880-84-0x0000000000000000-mapping.dmp
-
memory/932-57-0x0000000000000000-mapping.dmp
-
memory/1164-58-0x0000000000000000-mapping.dmp
-
memory/1296-55-0x0000000075781000-0x0000000075783000-memory.dmpFilesize
8KB
-
memory/1296-54-0x0000000000D90000-0x0000000000F3E000-memory.dmpFilesize
1.7MB
-
memory/1452-80-0x0000000000D80000-0x0000000000F2E000-memory.dmpFilesize
1.7MB
-
memory/1452-78-0x0000000000000000-mapping.dmp
-
memory/1600-95-0x00000000004C0000-0x00000000008A4000-memory.dmpFilesize
3.9MB
-
memory/1600-91-0x00000000004C0000-0x00000000008A4000-memory.dmpFilesize
3.9MB
-
memory/1600-92-0x00000000004C0000-0x00000000008A4000-memory.dmpFilesize
3.9MB
-
memory/1600-90-0x00000000007E2730-mapping.dmp
-
memory/1600-86-0x0000000000732000-0x00000000008A3000-memory.dmpFilesize
1.4MB
-
memory/1600-97-0x00000000004C0000-0x00000000008A4000-memory.dmpFilesize
3.9MB
-
memory/1600-98-0x00000000004C0000-0x00000000008A4000-memory.dmpFilesize
3.9MB
-
memory/1912-73-0x00000000000B0000-0x00000000000BA000-memory.dmpFilesize
40KB
-
memory/1912-65-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1912-76-0x00000000000B0000-0x00000000000BA000-memory.dmpFilesize
40KB
-
memory/1912-74-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1912-72-0x00000000000B0000-0x00000000000BA000-memory.dmpFilesize
40KB
-
memory/1912-71-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1912-70-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1912-59-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1912-69-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1912-75-0x00000000000B0000-0x00000000000BA000-memory.dmpFilesize
40KB
-
memory/1912-66-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1912-64-0x00000000007E2730-mapping.dmp
-
memory/1912-63-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1912-62-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1912-60-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1996-82-0x0000000000000000-mapping.dmp
-
memory/2028-56-0x0000000000000000-mapping.dmp