Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
29-07-2022 19:46
Static task
static1
Behavioral task
behavioral1
Sample
wdfvbn.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
wdfvbn.exe
Resource
win10v2004-20220721-en
General
-
Target
wdfvbn.exe
-
Size
289.4MB
-
MD5
566135e9a517a204c2e8fb2f7332ecdc
-
SHA1
4cde0ea64922233cafe2eba489a79d67222e2022
-
SHA256
1b3da7f55427827f44cafce5301508fb6e2806c387e5044479778c8dde87624a
-
SHA512
9caf700b65d48617e6df09f2754a212c0c90908695b9be0aa33c2e7640e0529d20a91b51eab6dd3a775a51b63f281dfd358afe271b1781cf16165bc24cb1bdfe
Malware Config
Extracted
bitrat
1.38
bitrat9300.duckdns.org:9300
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
wdfvbn.exepid process 1952 wdfvbn.exe -
Processes:
resource yara_rule behavioral1/memory/1128-59-0x0000000000460000-0x0000000000844000-memory.dmp upx behavioral1/memory/1128-62-0x0000000000460000-0x0000000000844000-memory.dmp upx behavioral1/memory/1128-64-0x0000000000460000-0x0000000000844000-memory.dmp upx behavioral1/memory/1128-66-0x0000000000460000-0x0000000000844000-memory.dmp upx behavioral1/memory/1128-71-0x0000000000460000-0x0000000000844000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
vbc.exepid process 1128 vbc.exe 1128 vbc.exe 1128 vbc.exe 1128 vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wdfvbn.exedescription pid process target process PID 736 set thread context of 1128 736 wdfvbn.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
wdfvbn.exevbc.exewdfvbn.exedescription pid process Token: SeDebugPrivilege 736 wdfvbn.exe Token: SeDebugPrivilege 1128 vbc.exe Token: SeShutdownPrivilege 1128 vbc.exe Token: SeDebugPrivilege 1952 wdfvbn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
vbc.exepid process 1128 vbc.exe 1128 vbc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
wdfvbn.execmd.exetaskeng.exedescription pid process target process PID 736 wrote to memory of 1128 736 wdfvbn.exe vbc.exe PID 736 wrote to memory of 1128 736 wdfvbn.exe vbc.exe PID 736 wrote to memory of 1128 736 wdfvbn.exe vbc.exe PID 736 wrote to memory of 1128 736 wdfvbn.exe vbc.exe PID 736 wrote to memory of 1128 736 wdfvbn.exe vbc.exe PID 736 wrote to memory of 1128 736 wdfvbn.exe vbc.exe PID 736 wrote to memory of 1128 736 wdfvbn.exe vbc.exe PID 736 wrote to memory of 1128 736 wdfvbn.exe vbc.exe PID 736 wrote to memory of 1452 736 wdfvbn.exe cmd.exe PID 736 wrote to memory of 1452 736 wdfvbn.exe cmd.exe PID 736 wrote to memory of 1452 736 wdfvbn.exe cmd.exe PID 736 wrote to memory of 1452 736 wdfvbn.exe cmd.exe PID 736 wrote to memory of 1740 736 wdfvbn.exe cmd.exe PID 736 wrote to memory of 1740 736 wdfvbn.exe cmd.exe PID 736 wrote to memory of 1740 736 wdfvbn.exe cmd.exe PID 736 wrote to memory of 1740 736 wdfvbn.exe cmd.exe PID 736 wrote to memory of 1716 736 wdfvbn.exe cmd.exe PID 736 wrote to memory of 1716 736 wdfvbn.exe cmd.exe PID 736 wrote to memory of 1716 736 wdfvbn.exe cmd.exe PID 736 wrote to memory of 1716 736 wdfvbn.exe cmd.exe PID 1740 wrote to memory of 472 1740 cmd.exe schtasks.exe PID 1740 wrote to memory of 472 1740 cmd.exe schtasks.exe PID 1740 wrote to memory of 472 1740 cmd.exe schtasks.exe PID 1740 wrote to memory of 472 1740 cmd.exe schtasks.exe PID 1068 wrote to memory of 1952 1068 taskeng.exe wdfvbn.exe PID 1068 wrote to memory of 1952 1068 taskeng.exe wdfvbn.exe PID 1068 wrote to memory of 1952 1068 taskeng.exe wdfvbn.exe PID 1068 wrote to memory of 1952 1068 taskeng.exe wdfvbn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\wdfvbn.exe"C:\Users\Admin\AppData\Local\Temp\wdfvbn.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1128 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wdfvbn"2⤵PID:1452
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe'" /f3⤵
- Creates scheduled task(s)
PID:472 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\wdfvbn.exe" "C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe"2⤵PID:1716
-
C:\Windows\system32\taskeng.exetaskeng.exe {504F31F9-67E6-4261-B49B-5D65C678DE32} S-1-5-21-3440072777-2118400376-1759599358-1000:NKWDSIWE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exeC:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1952
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exeFilesize
289.4MB
MD5566135e9a517a204c2e8fb2f7332ecdc
SHA14cde0ea64922233cafe2eba489a79d67222e2022
SHA2561b3da7f55427827f44cafce5301508fb6e2806c387e5044479778c8dde87624a
SHA5129caf700b65d48617e6df09f2754a212c0c90908695b9be0aa33c2e7640e0529d20a91b51eab6dd3a775a51b63f281dfd358afe271b1781cf16165bc24cb1bdfe
-
C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exeFilesize
289.4MB
MD5566135e9a517a204c2e8fb2f7332ecdc
SHA14cde0ea64922233cafe2eba489a79d67222e2022
SHA2561b3da7f55427827f44cafce5301508fb6e2806c387e5044479778c8dde87624a
SHA5129caf700b65d48617e6df09f2754a212c0c90908695b9be0aa33c2e7640e0529d20a91b51eab6dd3a775a51b63f281dfd358afe271b1781cf16165bc24cb1bdfe
-
memory/472-70-0x0000000000000000-mapping.dmp
-
memory/736-54-0x0000000000C90000-0x0000000000E52000-memory.dmpFilesize
1.8MB
-
memory/736-55-0x0000000076191000-0x0000000076193000-memory.dmpFilesize
8KB
-
memory/1128-66-0x0000000000460000-0x0000000000844000-memory.dmpFilesize
3.9MB
-
memory/1128-64-0x0000000000460000-0x0000000000844000-memory.dmpFilesize
3.9MB
-
memory/1128-62-0x0000000000460000-0x0000000000844000-memory.dmpFilesize
3.9MB
-
memory/1128-61-0x00000000007E2730-mapping.dmp
-
memory/1128-71-0x0000000000460000-0x0000000000844000-memory.dmpFilesize
3.9MB
-
memory/1128-59-0x0000000000460000-0x0000000000844000-memory.dmpFilesize
3.9MB
-
memory/1128-57-0x00000000006D2000-0x0000000000843000-memory.dmpFilesize
1.4MB
-
memory/1452-63-0x0000000000000000-mapping.dmp
-
memory/1716-69-0x0000000000000000-mapping.dmp
-
memory/1740-67-0x0000000000000000-mapping.dmp
-
memory/1952-73-0x0000000000000000-mapping.dmp
-
memory/1952-75-0x0000000000C90000-0x0000000000E52000-memory.dmpFilesize
1.8MB