Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
21-07-2022 20:01
Static task
static1
Behavioral task
behavioral1
Sample
1e01768f0a3e21c651b9912b7a1ffec3.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
1e01768f0a3e21c651b9912b7a1ffec3.exe
Resource
win10v2004-20220721-en
General
-
Target
1e01768f0a3e21c651b9912b7a1ffec3.exe
-
Size
1.3MB
-
MD5
1e01768f0a3e21c651b9912b7a1ffec3
-
SHA1
a685a29f95387428ce598fca8453b391ab8f2865
-
SHA256
6c86e7498865533229e0d51d8d0cf928e9bf129958e18ffe73b97410ca0589a8
-
SHA512
0606e6c8023cf21156fc9b72458d5b953454099c864e147136fb73e08d6bd4a7d81b3fc0f1f9caa82b9262f1503e3b2d7345e81974a52fd1f6413f8f4c64ca0b
Malware Config
Extracted
bitrat
1.38
markemoney.con-ip.com:3005
-
communication_password
202cb962ac59075b964b07152d234b70
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Processes:
resource yara_rule behavioral2/memory/1368-144-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1368-145-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1368-146-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1368-147-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1368-148-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1368-151-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1e01768f0a3e21c651b9912b7a1ffec3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation 1e01768f0a3e21c651b9912b7a1ffec3.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1e01768f0a3e21c651b9912b7a1ffec3.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zdqdiuzoa\\chrome.exe\"" 1e01768f0a3e21c651b9912b7a1ffec3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
InstallUtil.exepid process 1368 InstallUtil.exe 1368 InstallUtil.exe 1368 InstallUtil.exe 1368 InstallUtil.exe 1368 InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1e01768f0a3e21c651b9912b7a1ffec3.exedescription pid process target process PID 3604 set thread context of 1368 3604 1e01768f0a3e21c651b9912b7a1ffec3.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exe1e01768f0a3e21c651b9912b7a1ffec3.exepid process 2200 powershell.exe 2200 powershell.exe 3604 1e01768f0a3e21c651b9912b7a1ffec3.exe 3604 1e01768f0a3e21c651b9912b7a1ffec3.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
1e01768f0a3e21c651b9912b7a1ffec3.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 3604 1e01768f0a3e21c651b9912b7a1ffec3.exe Token: SeDebugPrivilege 2200 powershell.exe Token: SeShutdownPrivilege 1368 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
InstallUtil.exepid process 1368 InstallUtil.exe 1368 InstallUtil.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
1e01768f0a3e21c651b9912b7a1ffec3.exedescription pid process target process PID 3604 wrote to memory of 2200 3604 1e01768f0a3e21c651b9912b7a1ffec3.exe powershell.exe PID 3604 wrote to memory of 2200 3604 1e01768f0a3e21c651b9912b7a1ffec3.exe powershell.exe PID 3604 wrote to memory of 2200 3604 1e01768f0a3e21c651b9912b7a1ffec3.exe powershell.exe PID 3604 wrote to memory of 1368 3604 1e01768f0a3e21c651b9912b7a1ffec3.exe InstallUtil.exe PID 3604 wrote to memory of 1368 3604 1e01768f0a3e21c651b9912b7a1ffec3.exe InstallUtil.exe PID 3604 wrote to memory of 1368 3604 1e01768f0a3e21c651b9912b7a1ffec3.exe InstallUtil.exe PID 3604 wrote to memory of 1368 3604 1e01768f0a3e21c651b9912b7a1ffec3.exe InstallUtil.exe PID 3604 wrote to memory of 1368 3604 1e01768f0a3e21c651b9912b7a1ffec3.exe InstallUtil.exe PID 3604 wrote to memory of 1368 3604 1e01768f0a3e21c651b9912b7a1ffec3.exe InstallUtil.exe PID 3604 wrote to memory of 1368 3604 1e01768f0a3e21c651b9912b7a1ffec3.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e01768f0a3e21c651b9912b7a1ffec3.exe"C:\Users\Admin\AppData\Local\Temp\1e01768f0a3e21c651b9912b7a1ffec3.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1368-143-0x0000000000000000-mapping.dmp
-
memory/1368-153-0x0000000074DE0000-0x0000000074E19000-memory.dmpFilesize
228KB
-
memory/1368-152-0x0000000074A60000-0x0000000074A99000-memory.dmpFilesize
228KB
-
memory/1368-151-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1368-150-0x0000000074DE0000-0x0000000074E19000-memory.dmpFilesize
228KB
-
memory/1368-149-0x0000000074A60000-0x0000000074A99000-memory.dmpFilesize
228KB
-
memory/1368-148-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1368-147-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1368-146-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1368-145-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1368-144-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2200-136-0x0000000002AD0000-0x0000000002B06000-memory.dmpFilesize
216KB
-
memory/2200-141-0x0000000007900000-0x0000000007F7A000-memory.dmpFilesize
6.5MB
-
memory/2200-142-0x0000000006590000-0x00000000065AA000-memory.dmpFilesize
104KB
-
memory/2200-140-0x00000000060B0000-0x00000000060CE000-memory.dmpFilesize
120KB
-
memory/2200-139-0x0000000005A70000-0x0000000005AD6000-memory.dmpFilesize
408KB
-
memory/2200-138-0x0000000005A00000-0x0000000005A66000-memory.dmpFilesize
408KB
-
memory/2200-137-0x00000000052D0000-0x00000000058F8000-memory.dmpFilesize
6.2MB
-
memory/2200-135-0x0000000000000000-mapping.dmp
-
memory/3604-130-0x0000000000D10000-0x0000000000E5E000-memory.dmpFilesize
1.3MB
-
memory/3604-134-0x000000000BFE0000-0x000000000C002000-memory.dmpFilesize
136KB
-
memory/3604-133-0x00000000057F0000-0x00000000057FA000-memory.dmpFilesize
40KB
-
memory/3604-132-0x0000000005880000-0x0000000005912000-memory.dmpFilesize
584KB
-
memory/3604-131-0x0000000005E30000-0x00000000063D4000-memory.dmpFilesize
5.6MB