Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
28-07-2022 14:51
Static task
static1
Behavioral task
behavioral1
Sample
tmpbg_av_60.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
tmpbg_av_60.exe
Resource
win10v2004-20220722-en
General
-
Target
tmpbg_av_60.exe
-
Size
1.7MB
-
MD5
fad1b418110d37814930646d24ab4239
-
SHA1
f39606e98088b8e3e6d3707954c53385caf7f88a
-
SHA256
23f0dcf06d4c4a7354f3e7f013022ed26afa823556e444054c1b0b4aec0bce78
-
SHA512
d8c147683a4728383e80565ce538a0f12ad3191928158c33a65dfd6896e9ac33c58715fb199a88341ee206c6b85d18e7325d55616ebbbcc3c691c0f7f1344b97
Malware Config
Extracted
bitrat
1.38
kot-pandora.duckdns.org:24993
-
communication_password
d6723e7cd6735df68d1ce4c704c29a04
-
tor_process
tor
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rewfv.exepid process 552 rewfv.exe -
Processes:
resource yara_rule behavioral1/memory/1192-59-0x0000000000430000-0x0000000000814000-memory.dmp upx behavioral1/memory/1192-62-0x0000000000430000-0x0000000000814000-memory.dmp upx behavioral1/memory/1192-63-0x0000000000430000-0x0000000000814000-memory.dmp upx behavioral1/memory/1192-67-0x0000000000430000-0x0000000000814000-memory.dmp upx behavioral1/memory/1192-71-0x0000000000430000-0x0000000000814000-memory.dmp upx behavioral1/memory/1192-77-0x0000000000430000-0x0000000000814000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
RegAsm.exepid process 1192 RegAsm.exe 1192 RegAsm.exe 1192 RegAsm.exe 1192 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmpbg_av_60.exedescription pid process target process PID 640 set thread context of 1192 640 tmpbg_av_60.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
tmpbg_av_60.exeRegAsm.exerewfv.exedescription pid process Token: SeDebugPrivilege 640 tmpbg_av_60.exe Token: SeDebugPrivilege 1192 RegAsm.exe Token: SeShutdownPrivilege 1192 RegAsm.exe Token: SeDebugPrivilege 552 rewfv.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 1192 RegAsm.exe 1192 RegAsm.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
tmpbg_av_60.execmd.exetaskeng.exedescription pid process target process PID 640 wrote to memory of 1192 640 tmpbg_av_60.exe RegAsm.exe PID 640 wrote to memory of 1192 640 tmpbg_av_60.exe RegAsm.exe PID 640 wrote to memory of 1192 640 tmpbg_av_60.exe RegAsm.exe PID 640 wrote to memory of 1192 640 tmpbg_av_60.exe RegAsm.exe PID 640 wrote to memory of 1192 640 tmpbg_av_60.exe RegAsm.exe PID 640 wrote to memory of 1192 640 tmpbg_av_60.exe RegAsm.exe PID 640 wrote to memory of 1192 640 tmpbg_av_60.exe RegAsm.exe PID 640 wrote to memory of 1192 640 tmpbg_av_60.exe RegAsm.exe PID 640 wrote to memory of 1192 640 tmpbg_av_60.exe RegAsm.exe PID 640 wrote to memory of 1192 640 tmpbg_av_60.exe RegAsm.exe PID 640 wrote to memory of 1192 640 tmpbg_av_60.exe RegAsm.exe PID 640 wrote to memory of 956 640 tmpbg_av_60.exe cmd.exe PID 640 wrote to memory of 956 640 tmpbg_av_60.exe cmd.exe PID 640 wrote to memory of 956 640 tmpbg_av_60.exe cmd.exe PID 640 wrote to memory of 956 640 tmpbg_av_60.exe cmd.exe PID 956 wrote to memory of 1176 956 cmd.exe schtasks.exe PID 956 wrote to memory of 1176 956 cmd.exe schtasks.exe PID 956 wrote to memory of 1176 956 cmd.exe schtasks.exe PID 956 wrote to memory of 1176 956 cmd.exe schtasks.exe PID 640 wrote to memory of 1180 640 tmpbg_av_60.exe cmd.exe PID 640 wrote to memory of 1180 640 tmpbg_av_60.exe cmd.exe PID 640 wrote to memory of 1180 640 tmpbg_av_60.exe cmd.exe PID 640 wrote to memory of 1180 640 tmpbg_av_60.exe cmd.exe PID 1484 wrote to memory of 552 1484 taskeng.exe rewfv.exe PID 1484 wrote to memory of 552 1484 taskeng.exe rewfv.exe PID 1484 wrote to memory of 552 1484 taskeng.exe rewfv.exe PID 1484 wrote to memory of 552 1484 taskeng.exe rewfv.exe PID 1484 wrote to memory of 552 1484 taskeng.exe rewfv.exe PID 1484 wrote to memory of 552 1484 taskeng.exe rewfv.exe PID 1484 wrote to memory of 552 1484 taskeng.exe rewfv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpbg_av_60.exe"C:\Users\Admin\AppData\Local\Temp\tmpbg_av_60.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\rewfv\rewfv.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\rewfv\rewfv.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\tmpbg_av_60.exe" "C:\Users\Admin\AppData\Roaming\rewfv\rewfv.exe"2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {D1A42229-8757-4180-AAEE-C880A2EAB396} S-1-5-21-4084403625-2215941253-1760665084-1000:LDLTPJLN\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\rewfv\rewfv.exeC:\Users\Admin\AppData\Roaming\rewfv\rewfv.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\rewfv\rewfv.exeFilesize
1.7MB
MD5fad1b418110d37814930646d24ab4239
SHA1f39606e98088b8e3e6d3707954c53385caf7f88a
SHA25623f0dcf06d4c4a7354f3e7f013022ed26afa823556e444054c1b0b4aec0bce78
SHA512d8c147683a4728383e80565ce538a0f12ad3191928158c33a65dfd6896e9ac33c58715fb199a88341ee206c6b85d18e7325d55616ebbbcc3c691c0f7f1344b97
-
C:\Users\Admin\AppData\Roaming\rewfv\rewfv.exeFilesize
1.7MB
MD5fad1b418110d37814930646d24ab4239
SHA1f39606e98088b8e3e6d3707954c53385caf7f88a
SHA25623f0dcf06d4c4a7354f3e7f013022ed26afa823556e444054c1b0b4aec0bce78
SHA512d8c147683a4728383e80565ce538a0f12ad3191928158c33a65dfd6896e9ac33c58715fb199a88341ee206c6b85d18e7325d55616ebbbcc3c691c0f7f1344b97
-
memory/552-75-0x0000000001130000-0x00000000012F0000-memory.dmpFilesize
1.8MB
-
memory/552-73-0x0000000000000000-mapping.dmp
-
memory/640-55-0x0000000076921000-0x0000000076923000-memory.dmpFilesize
8KB
-
memory/640-54-0x0000000000C90000-0x0000000000E50000-memory.dmpFilesize
1.8MB
-
memory/956-64-0x0000000000000000-mapping.dmp
-
memory/1176-68-0x0000000000000000-mapping.dmp
-
memory/1180-70-0x0000000000000000-mapping.dmp
-
memory/1192-61-0x00000000007E2740-mapping.dmp
-
memory/1192-67-0x0000000000430000-0x0000000000814000-memory.dmpFilesize
3.9MB
-
memory/1192-71-0x0000000000430000-0x0000000000814000-memory.dmpFilesize
3.9MB
-
memory/1192-63-0x0000000000430000-0x0000000000814000-memory.dmpFilesize
3.9MB
-
memory/1192-62-0x0000000000430000-0x0000000000814000-memory.dmpFilesize
3.9MB
-
memory/1192-59-0x0000000000430000-0x0000000000814000-memory.dmpFilesize
3.9MB
-
memory/1192-57-0x00000000006A2000-0x0000000000813000-memory.dmpFilesize
1.4MB
-
memory/1192-77-0x0000000000430000-0x0000000000814000-memory.dmpFilesize
3.9MB