Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 05:07
Behavioral task
behavioral1
Sample
copw.exe
Resource
win7-20220718-en
windows7-x64
5 signatures
150 seconds
General
-
Target
copw.exe
-
Size
1.4MB
-
MD5
88992f8dbb079ae5f9754ed265c02f55
-
SHA1
c05d4025024da67569c53afabbdda51dabae6521
-
SHA256
9288f5f8898d70977cd45f6527ada3a36bdb76ae7accb3401b9c84189f18cc2c
-
SHA512
83e02f354a883fa35431b86e41c875e4b3ba4664ab60eb677273bda514b079a9d075a51c1c933106a2c3da330ac22599a4a4ecfaac4dc62a8f41806d698ed911
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
wer89.duckdns.org:2222
Attributes
-
communication_password
653d716345d8915046b904b90f41f271
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral1/memory/892-55-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/892-56-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
copw.exepid process 892 copw.exe 892 copw.exe 892 copw.exe 892 copw.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
copw.exedescription pid process Token: SeDebugPrivilege 892 copw.exe Token: SeShutdownPrivilege 892 copw.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
copw.exepid process 892 copw.exe 892 copw.exe