Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
27-07-2022 21:51
Behavioral task
behavioral1
Sample
d30ae9e3c1a66b23090622a255dfb918.exe
Resource
win7-20220715-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d30ae9e3c1a66b23090622a255dfb918.exe
-
Size
1.4MB
-
MD5
d30ae9e3c1a66b23090622a255dfb918
-
SHA1
e55b120b9cc8cd726365a6360be96a00d8cad60e
-
SHA256
5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588
-
SHA512
499402535612aab28a032b432fb594db9636e313dcad28a9df8db3a88b3d3e70b5ddcf37a6c266dd5afbaafa85bdb85955b15feaae51e8863ee7ba56928db1d7
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
103.133.105.50:1234
Attributes
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1480-55-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1480-58-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
d30ae9e3c1a66b23090622a255dfb918.exepid process 1480 d30ae9e3c1a66b23090622a255dfb918.exe 1480 d30ae9e3c1a66b23090622a255dfb918.exe 1480 d30ae9e3c1a66b23090622a255dfb918.exe 1480 d30ae9e3c1a66b23090622a255dfb918.exe 1480 d30ae9e3c1a66b23090622a255dfb918.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d30ae9e3c1a66b23090622a255dfb918.exedescription pid process Token: SeDebugPrivilege 1480 d30ae9e3c1a66b23090622a255dfb918.exe Token: SeShutdownPrivilege 1480 d30ae9e3c1a66b23090622a255dfb918.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
d30ae9e3c1a66b23090622a255dfb918.exepid process 1480 d30ae9e3c1a66b23090622a255dfb918.exe 1480 d30ae9e3c1a66b23090622a255dfb918.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1480-54-0x0000000076311000-0x0000000076313000-memory.dmpFilesize
8KB
-
memory/1480-55-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1480-56-0x00000000002F0000-0x00000000002FA000-memory.dmpFilesize
40KB
-
memory/1480-57-0x00000000002F0000-0x00000000002FA000-memory.dmpFilesize
40KB
-
memory/1480-58-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1480-59-0x00000000002F0000-0x00000000002FA000-memory.dmpFilesize
40KB