Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
17-08-2022 07:36
Static task
static1
Behavioral task
behavioral1
Sample
91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe
Resource
win7-20220812-en
General
-
Target
91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe
-
Size
1.5MB
-
MD5
45a7d174e1fee169316107638d633985
-
SHA1
0f6bb823d193e4ab8b3ac4facb9c55a0654927f2
-
SHA256
91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655
-
SHA512
ac3253f8c40bf7cff08dfda0d01e826ffdb5dcc958aa545e4fc0309b115a533f4b69a00329273516cb6a79eee6d503b56236f9c3d6f5635d626dcd283095c028
Malware Config
Extracted
bitrat
1.38
bitrat9300.duckdns.org:9300
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
pmfre.exepmfre.exepid process 1324 pmfre.exe 1468 pmfre.exe -
Processes:
resource yara_rule behavioral1/memory/1284-60-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1284-62-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1284-63-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1284-66-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1284-65-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1284-69-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1284-70-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1284-71-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1284-74-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/108-91-0x0000000000410000-0x00000000007F4000-memory.dmp upx behavioral1/memory/108-92-0x0000000000410000-0x00000000007F4000-memory.dmp upx behavioral1/memory/108-95-0x0000000000410000-0x00000000007F4000-memory.dmp upx behavioral1/memory/108-97-0x0000000000410000-0x00000000007F4000-memory.dmp upx behavioral1/memory/108-98-0x0000000000410000-0x00000000007F4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
RegAsm.exeRegAsm.exepid process 1284 RegAsm.exe 1284 RegAsm.exe 1284 RegAsm.exe 1284 RegAsm.exe 1284 RegAsm.exe 108 RegAsm.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exepmfre.exedescription pid process target process PID 1960 set thread context of 1284 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe RegAsm.exe PID 1324 set thread context of 108 1324 pmfre.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1056 schtasks.exe 1512 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RegAsm.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1284 RegAsm.exe Token: SeShutdownPrivilege 1284 RegAsm.exe Token: SeDebugPrivilege 108 RegAsm.exe Token: SeShutdownPrivilege 108 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 1284 RegAsm.exe 1284 RegAsm.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.execmd.exetaskeng.exepmfre.execmd.exedescription pid process target process PID 1960 wrote to memory of 1608 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe cmd.exe PID 1960 wrote to memory of 1608 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe cmd.exe PID 1960 wrote to memory of 1608 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe cmd.exe PID 1960 wrote to memory of 1608 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe cmd.exe PID 1960 wrote to memory of 1336 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe cmd.exe PID 1960 wrote to memory of 1336 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe cmd.exe PID 1960 wrote to memory of 1336 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe cmd.exe PID 1960 wrote to memory of 1336 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe cmd.exe PID 1608 wrote to memory of 1512 1608 cmd.exe schtasks.exe PID 1608 wrote to memory of 1512 1608 cmd.exe schtasks.exe PID 1608 wrote to memory of 1512 1608 cmd.exe schtasks.exe PID 1608 wrote to memory of 1512 1608 cmd.exe schtasks.exe PID 1960 wrote to memory of 1284 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe RegAsm.exe PID 1960 wrote to memory of 1284 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe RegAsm.exe PID 1960 wrote to memory of 1284 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe RegAsm.exe PID 1960 wrote to memory of 1284 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe RegAsm.exe PID 1960 wrote to memory of 1284 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe RegAsm.exe PID 1960 wrote to memory of 1284 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe RegAsm.exe PID 1960 wrote to memory of 1284 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe RegAsm.exe PID 1960 wrote to memory of 1284 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe RegAsm.exe PID 1960 wrote to memory of 1284 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe RegAsm.exe PID 1960 wrote to memory of 1284 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe RegAsm.exe PID 1960 wrote to memory of 1284 1960 91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe RegAsm.exe PID 1768 wrote to memory of 1324 1768 taskeng.exe pmfre.exe PID 1768 wrote to memory of 1324 1768 taskeng.exe pmfre.exe PID 1768 wrote to memory of 1324 1768 taskeng.exe pmfre.exe PID 1768 wrote to memory of 1324 1768 taskeng.exe pmfre.exe PID 1324 wrote to memory of 688 1324 pmfre.exe cmd.exe PID 1324 wrote to memory of 688 1324 pmfre.exe cmd.exe PID 1324 wrote to memory of 688 1324 pmfre.exe cmd.exe PID 1324 wrote to memory of 688 1324 pmfre.exe cmd.exe PID 1324 wrote to memory of 976 1324 pmfre.exe cmd.exe PID 1324 wrote to memory of 976 1324 pmfre.exe cmd.exe PID 1324 wrote to memory of 976 1324 pmfre.exe cmd.exe PID 1324 wrote to memory of 976 1324 pmfre.exe cmd.exe PID 688 wrote to memory of 1056 688 cmd.exe schtasks.exe PID 688 wrote to memory of 1056 688 cmd.exe schtasks.exe PID 688 wrote to memory of 1056 688 cmd.exe schtasks.exe PID 688 wrote to memory of 1056 688 cmd.exe schtasks.exe PID 1324 wrote to memory of 108 1324 pmfre.exe RegAsm.exe PID 1324 wrote to memory of 108 1324 pmfre.exe RegAsm.exe PID 1324 wrote to memory of 108 1324 pmfre.exe RegAsm.exe PID 1324 wrote to memory of 108 1324 pmfre.exe RegAsm.exe PID 1324 wrote to memory of 108 1324 pmfre.exe RegAsm.exe PID 1324 wrote to memory of 108 1324 pmfre.exe RegAsm.exe PID 1324 wrote to memory of 108 1324 pmfre.exe RegAsm.exe PID 1324 wrote to memory of 108 1324 pmfre.exe RegAsm.exe PID 1324 wrote to memory of 108 1324 pmfre.exe RegAsm.exe PID 1324 wrote to memory of 108 1324 pmfre.exe RegAsm.exe PID 1324 wrote to memory of 108 1324 pmfre.exe RegAsm.exe PID 1768 wrote to memory of 1468 1768 taskeng.exe pmfre.exe PID 1768 wrote to memory of 1468 1768 taskeng.exe pmfre.exe PID 1768 wrote to memory of 1468 1768 taskeng.exe pmfre.exe PID 1768 wrote to memory of 1468 1768 taskeng.exe pmfre.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe"C:\Users\Admin\AppData\Local\Temp\91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\pmfre.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\pmfre.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\91eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655.exe" "C:\Users\Admin\AppData\Roaming\pmfre.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskeng.exetaskeng.exe {72674F78-3078-4224-B308-9118A466D550} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\pmfre.exeC:\Users\Admin\AppData\Roaming\pmfre.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\pmfre.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\pmfre.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\pmfre.exe" "C:\Users\Admin\AppData\Roaming\pmfre.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\pmfre.exeC:\Users\Admin\AppData\Roaming\pmfre.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\pmfre.exeFilesize
1.5MB
MD545a7d174e1fee169316107638d633985
SHA10f6bb823d193e4ab8b3ac4facb9c55a0654927f2
SHA25691eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655
SHA512ac3253f8c40bf7cff08dfda0d01e826ffdb5dcc958aa545e4fc0309b115a533f4b69a00329273516cb6a79eee6d503b56236f9c3d6f5635d626dcd283095c028
-
C:\Users\Admin\AppData\Roaming\pmfre.exeFilesize
1.5MB
MD545a7d174e1fee169316107638d633985
SHA10f6bb823d193e4ab8b3ac4facb9c55a0654927f2
SHA25691eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655
SHA512ac3253f8c40bf7cff08dfda0d01e826ffdb5dcc958aa545e4fc0309b115a533f4b69a00329273516cb6a79eee6d503b56236f9c3d6f5635d626dcd283095c028
-
C:\Users\Admin\AppData\Roaming\pmfre.exeFilesize
1.5MB
MD545a7d174e1fee169316107638d633985
SHA10f6bb823d193e4ab8b3ac4facb9c55a0654927f2
SHA25691eae4dde94e8192a5050abda781916bc08e16c52595a2e97d3b0000ae64a655
SHA512ac3253f8c40bf7cff08dfda0d01e826ffdb5dcc958aa545e4fc0309b115a533f4b69a00329273516cb6a79eee6d503b56236f9c3d6f5635d626dcd283095c028
-
memory/108-91-0x0000000000410000-0x00000000007F4000-memory.dmpFilesize
3.9MB
-
memory/108-95-0x0000000000410000-0x00000000007F4000-memory.dmpFilesize
3.9MB
-
memory/108-92-0x0000000000410000-0x00000000007F4000-memory.dmpFilesize
3.9MB
-
memory/108-97-0x0000000000410000-0x00000000007F4000-memory.dmpFilesize
3.9MB
-
memory/108-90-0x00000000007E2730-mapping.dmp
-
memory/108-86-0x0000000000682000-0x00000000007F3000-memory.dmpFilesize
1.4MB
-
memory/108-98-0x0000000000410000-0x00000000007F4000-memory.dmpFilesize
3.9MB
-
memory/688-82-0x0000000000000000-mapping.dmp
-
memory/976-83-0x0000000000000000-mapping.dmp
-
memory/1056-84-0x0000000000000000-mapping.dmp
-
memory/1284-64-0x00000000007E2730-mapping.dmp
-
memory/1284-65-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1284-72-0x0000000000140000-0x000000000014A000-memory.dmpFilesize
40KB
-
memory/1284-73-0x0000000000140000-0x000000000014A000-memory.dmpFilesize
40KB
-
memory/1284-74-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1284-75-0x0000000000140000-0x000000000014A000-memory.dmpFilesize
40KB
-
memory/1284-76-0x0000000000140000-0x000000000014A000-memory.dmpFilesize
40KB
-
memory/1284-70-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1284-69-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1284-59-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1284-60-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1284-71-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1284-66-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1284-62-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1284-63-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1324-80-0x0000000000980000-0x0000000000B12000-memory.dmpFilesize
1.6MB
-
memory/1324-78-0x0000000000000000-mapping.dmp
-
memory/1336-57-0x0000000000000000-mapping.dmp
-
memory/1468-99-0x0000000000000000-mapping.dmp
-
memory/1468-101-0x0000000000BA0000-0x0000000000D32000-memory.dmpFilesize
1.6MB
-
memory/1512-58-0x0000000000000000-mapping.dmp
-
memory/1608-56-0x0000000000000000-mapping.dmp
-
memory/1960-54-0x0000000000380000-0x0000000000512000-memory.dmpFilesize
1.6MB
-
memory/1960-55-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB