Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2022 05:29
Static task
static1
Behavioral task
behavioral1
Sample
ETRANSFER_RECEIPT.exe
Resource
win7-20220812-en
General
-
Target
ETRANSFER_RECEIPT.exe
-
Size
300.0MB
-
MD5
8dac8b61bf8c23264873a3f3bee260f5
-
SHA1
ba581c38574794324ea714a48671fad7f2384dbe
-
SHA256
7e4a1f93d53d3962a913e000524344bdcccd6d36d0856b3df38df57d4a8e1df3
-
SHA512
65ef0b281583e1f8303ff470dc134d8d35ccc394521fd93294cd251220af501137b17d39af91829efe0191e395c2494e1652565895647bf04a46b56fe0eae163
Malware Config
Extracted
bitrat
1.38
bitrat9300.duckdns.org:9300
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
olkij.exepid process 2484 olkij.exe -
Processes:
resource yara_rule behavioral2/memory/3956-138-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3956-139-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3956-140-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3956-141-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3956-142-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3956-145-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
RegAsm.exepid process 3956 RegAsm.exe 3956 RegAsm.exe 3956 RegAsm.exe 3956 RegAsm.exe 3956 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ETRANSFER_RECEIPT.exedescription pid process target process PID 4492 set thread context of 3956 4492 ETRANSFER_RECEIPT.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeShutdownPrivilege 3956 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 3956 RegAsm.exe 3956 RegAsm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
ETRANSFER_RECEIPT.execmd.exedescription pid process target process PID 4492 wrote to memory of 2848 4492 ETRANSFER_RECEIPT.exe cmd.exe PID 4492 wrote to memory of 2848 4492 ETRANSFER_RECEIPT.exe cmd.exe PID 4492 wrote to memory of 2848 4492 ETRANSFER_RECEIPT.exe cmd.exe PID 4492 wrote to memory of 440 4492 ETRANSFER_RECEIPT.exe cmd.exe PID 4492 wrote to memory of 440 4492 ETRANSFER_RECEIPT.exe cmd.exe PID 4492 wrote to memory of 440 4492 ETRANSFER_RECEIPT.exe cmd.exe PID 2848 wrote to memory of 116 2848 cmd.exe schtasks.exe PID 2848 wrote to memory of 116 2848 cmd.exe schtasks.exe PID 2848 wrote to memory of 116 2848 cmd.exe schtasks.exe PID 4492 wrote to memory of 3956 4492 ETRANSFER_RECEIPT.exe RegAsm.exe PID 4492 wrote to memory of 3956 4492 ETRANSFER_RECEIPT.exe RegAsm.exe PID 4492 wrote to memory of 3956 4492 ETRANSFER_RECEIPT.exe RegAsm.exe PID 4492 wrote to memory of 3956 4492 ETRANSFER_RECEIPT.exe RegAsm.exe PID 4492 wrote to memory of 3956 4492 ETRANSFER_RECEIPT.exe RegAsm.exe PID 4492 wrote to memory of 3956 4492 ETRANSFER_RECEIPT.exe RegAsm.exe PID 4492 wrote to memory of 3956 4492 ETRANSFER_RECEIPT.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ETRANSFER_RECEIPT.exe"C:\Users\Admin\AppData\Local\Temp\ETRANSFER_RECEIPT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Local\Temp\olkij.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Local\Temp\olkij.exe'" /f3⤵
- Creates scheduled task(s)
PID:116 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\ETRANSFER_RECEIPT.exe" "C:\Users\Admin\AppData\Local\Temp\olkij.exe"2⤵PID:440
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3956
-
C:\Users\Admin\AppData\Local\Temp\olkij.exeC:\Users\Admin\AppData\Local\Temp\olkij.exe1⤵
- Executes dropped EXE
PID:2484
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\olkij.exeFilesize
300.0MB
MD58dac8b61bf8c23264873a3f3bee260f5
SHA1ba581c38574794324ea714a48671fad7f2384dbe
SHA2567e4a1f93d53d3962a913e000524344bdcccd6d36d0856b3df38df57d4a8e1df3
SHA51265ef0b281583e1f8303ff470dc134d8d35ccc394521fd93294cd251220af501137b17d39af91829efe0191e395c2494e1652565895647bf04a46b56fe0eae163
-
C:\Users\Admin\AppData\Local\Temp\olkij.exeFilesize
300.0MB
MD58dac8b61bf8c23264873a3f3bee260f5
SHA1ba581c38574794324ea714a48671fad7f2384dbe
SHA2567e4a1f93d53d3962a913e000524344bdcccd6d36d0856b3df38df57d4a8e1df3
SHA51265ef0b281583e1f8303ff470dc134d8d35ccc394521fd93294cd251220af501137b17d39af91829efe0191e395c2494e1652565895647bf04a46b56fe0eae163
-
memory/116-136-0x0000000000000000-mapping.dmp
-
memory/440-135-0x0000000000000000-mapping.dmp
-
memory/2848-134-0x0000000000000000-mapping.dmp
-
memory/3956-140-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3956-138-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3956-139-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3956-141-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3956-142-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3956-143-0x0000000074270000-0x00000000742A9000-memory.dmpFilesize
228KB
-
memory/3956-144-0x0000000074610000-0x0000000074649000-memory.dmpFilesize
228KB
-
memory/3956-145-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3956-137-0x0000000000000000-mapping.dmp
-
memory/4492-132-0x0000000000C70000-0x0000000000DFA000-memory.dmpFilesize
1.5MB
-
memory/4492-133-0x0000000005F60000-0x0000000006504000-memory.dmpFilesize
5.6MB