Analysis
-
max time kernel
154s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
09-09-2022 18:17
Static task
static1
Behavioral task
behavioral1
Sample
BILLPAYM.exe
Resource
win7-20220901-en
General
-
Target
BILLPAYM.exe
-
Size
300.0MB
-
MD5
41d8a777ddc40a009a046f88900c0b80
-
SHA1
25dfd72ffe79eb5884d27fead86f4886bed638de
-
SHA256
e6844a84f9210b5803147c158c841404331177bf409dab05fecb3b3303d50347
-
SHA512
e75f3bfc85ed1def013474d61d5ee936ce36f499e0e111a7a1264180b7c7cc0b9a35469c35549e14c5efccc105db509aa5935152aab4e028b038e12b126f4514
-
SSDEEP
24576:R+GQ7D8nXiNeGFPQKpFCjI/teJb2Q/eF2YlIECXRPbSVKcS2nOI3lqaNJJxEJYsO:R+GaeGtpFC8/mb9ejKulkPaNJo
Malware Config
Extracted
bitrat
1.38
newbithere.duckdns.org:2005
-
communication_password
827ccb0eea8a706c4c34a16891f84e7b
-
tor_process
tor
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Windows.exeWindows.exepid process 1256 Windows.exe 1060 Windows.exe -
Processes:
resource yara_rule behavioral1/memory/528-60-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/528-62-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/528-63-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/528-65-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/528-66-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/528-69-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/528-70-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/528-71-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/528-72-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1372-97-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1372-98-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
RegAsm.exeRegAsm.exepid process 528 RegAsm.exe 528 RegAsm.exe 528 RegAsm.exe 528 RegAsm.exe 528 RegAsm.exe 1372 RegAsm.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
BILLPAYM.exeWindows.exeWindows.exedescription pid process target process PID 1700 set thread context of 528 1700 BILLPAYM.exe RegAsm.exe PID 1256 set thread context of 1372 1256 Windows.exe RegAsm.exe PID 1060 set thread context of 1908 1060 Windows.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 392 schtasks.exe 1208 schtasks.exe 1116 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RegAsm.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 528 RegAsm.exe Token: SeShutdownPrivilege 528 RegAsm.exe Token: SeDebugPrivilege 1372 RegAsm.exe Token: SeShutdownPrivilege 1372 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 528 RegAsm.exe 528 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BILLPAYM.execmd.exetaskeng.exeWindows.execmd.exeWindows.exedescription pid process target process PID 1700 wrote to memory of 940 1700 BILLPAYM.exe cmd.exe PID 1700 wrote to memory of 940 1700 BILLPAYM.exe cmd.exe PID 1700 wrote to memory of 940 1700 BILLPAYM.exe cmd.exe PID 1700 wrote to memory of 940 1700 BILLPAYM.exe cmd.exe PID 1700 wrote to memory of 1644 1700 BILLPAYM.exe cmd.exe PID 1700 wrote to memory of 1644 1700 BILLPAYM.exe cmd.exe PID 1700 wrote to memory of 1644 1700 BILLPAYM.exe cmd.exe PID 1700 wrote to memory of 1644 1700 BILLPAYM.exe cmd.exe PID 940 wrote to memory of 392 940 cmd.exe schtasks.exe PID 940 wrote to memory of 392 940 cmd.exe schtasks.exe PID 940 wrote to memory of 392 940 cmd.exe schtasks.exe PID 940 wrote to memory of 392 940 cmd.exe schtasks.exe PID 1700 wrote to memory of 528 1700 BILLPAYM.exe RegAsm.exe PID 1700 wrote to memory of 528 1700 BILLPAYM.exe RegAsm.exe PID 1700 wrote to memory of 528 1700 BILLPAYM.exe RegAsm.exe PID 1700 wrote to memory of 528 1700 BILLPAYM.exe RegAsm.exe PID 1700 wrote to memory of 528 1700 BILLPAYM.exe RegAsm.exe PID 1700 wrote to memory of 528 1700 BILLPAYM.exe RegAsm.exe PID 1700 wrote to memory of 528 1700 BILLPAYM.exe RegAsm.exe PID 1700 wrote to memory of 528 1700 BILLPAYM.exe RegAsm.exe PID 1700 wrote to memory of 528 1700 BILLPAYM.exe RegAsm.exe PID 1700 wrote to memory of 528 1700 BILLPAYM.exe RegAsm.exe PID 1700 wrote to memory of 528 1700 BILLPAYM.exe RegAsm.exe PID 1748 wrote to memory of 1256 1748 taskeng.exe Windows.exe PID 1748 wrote to memory of 1256 1748 taskeng.exe Windows.exe PID 1748 wrote to memory of 1256 1748 taskeng.exe Windows.exe PID 1748 wrote to memory of 1256 1748 taskeng.exe Windows.exe PID 1256 wrote to memory of 2004 1256 Windows.exe cmd.exe PID 1256 wrote to memory of 2004 1256 Windows.exe cmd.exe PID 1256 wrote to memory of 2004 1256 Windows.exe cmd.exe PID 1256 wrote to memory of 2004 1256 Windows.exe cmd.exe PID 1256 wrote to memory of 1320 1256 Windows.exe cmd.exe PID 1256 wrote to memory of 1320 1256 Windows.exe cmd.exe PID 1256 wrote to memory of 1320 1256 Windows.exe cmd.exe PID 1256 wrote to memory of 1320 1256 Windows.exe cmd.exe PID 2004 wrote to memory of 1208 2004 cmd.exe schtasks.exe PID 2004 wrote to memory of 1208 2004 cmd.exe schtasks.exe PID 2004 wrote to memory of 1208 2004 cmd.exe schtasks.exe PID 2004 wrote to memory of 1208 2004 cmd.exe schtasks.exe PID 1256 wrote to memory of 1372 1256 Windows.exe RegAsm.exe PID 1256 wrote to memory of 1372 1256 Windows.exe RegAsm.exe PID 1256 wrote to memory of 1372 1256 Windows.exe RegAsm.exe PID 1256 wrote to memory of 1372 1256 Windows.exe RegAsm.exe PID 1256 wrote to memory of 1372 1256 Windows.exe RegAsm.exe PID 1256 wrote to memory of 1372 1256 Windows.exe RegAsm.exe PID 1256 wrote to memory of 1372 1256 Windows.exe RegAsm.exe PID 1256 wrote to memory of 1372 1256 Windows.exe RegAsm.exe PID 1256 wrote to memory of 1372 1256 Windows.exe RegAsm.exe PID 1256 wrote to memory of 1372 1256 Windows.exe RegAsm.exe PID 1256 wrote to memory of 1372 1256 Windows.exe RegAsm.exe PID 1748 wrote to memory of 1060 1748 taskeng.exe Windows.exe PID 1748 wrote to memory of 1060 1748 taskeng.exe Windows.exe PID 1748 wrote to memory of 1060 1748 taskeng.exe Windows.exe PID 1748 wrote to memory of 1060 1748 taskeng.exe Windows.exe PID 1060 wrote to memory of 1940 1060 Windows.exe cmd.exe PID 1060 wrote to memory of 1940 1060 Windows.exe cmd.exe PID 1060 wrote to memory of 1940 1060 Windows.exe cmd.exe PID 1060 wrote to memory of 1940 1060 Windows.exe cmd.exe PID 1060 wrote to memory of 1736 1060 Windows.exe cmd.exe PID 1060 wrote to memory of 1736 1060 Windows.exe cmd.exe PID 1060 wrote to memory of 1736 1060 Windows.exe cmd.exe PID 1060 wrote to memory of 1736 1060 Windows.exe cmd.exe PID 1060 wrote to memory of 1908 1060 Windows.exe RegAsm.exe PID 1060 wrote to memory of 1908 1060 Windows.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BILLPAYM.exe"C:\Users\Admin\AppData\Local\Temp\BILLPAYM.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Windows.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Windows.exe'" /f3⤵
- Creates scheduled task(s)
PID:392 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\BILLPAYM.exe" "C:\Users\Admin\AppData\Roaming\Windows.exe"2⤵PID:1644
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:528
-
C:\Windows\system32\taskeng.exetaskeng.exe {D6E2D0EE-8E54-4061-BCA2-649B407DB326} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Roaming\Windows.exeC:\Users\Admin\AppData\Roaming\Windows.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Windows.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Windows.exe'" /f4⤵
- Creates scheduled task(s)
PID:1208 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Windows.exe" "C:\Users\Admin\AppData\Roaming\Windows.exe"3⤵PID:1320
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1372 -
C:\Users\Admin\AppData\Roaming\Windows.exeC:\Users\Admin\AppData\Roaming\Windows.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Windows.exe'" /f3⤵PID:1940
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Windows.exe'" /f4⤵
- Creates scheduled task(s)
PID:1116 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Windows.exe" "C:\Users\Admin\AppData\Roaming\Windows.exe"3⤵PID:1736
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:1908
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238.8MB
MD5e1d49241e373e6bb2f6dc86c24f0149f
SHA138b6c229aaba10eacc3cd590d3ebb679df704314
SHA25647afa144c77db336f5f2d45bffd7f9fd77459c2ab395c05cf9a33749b1f1c0d6
SHA512eff3558d91abbf2b6c50558b1d33032d7ae7eee14ae1df990e40828579a547aac28f1fc065b75b9791f4cdc802fe7394075189a385ec090190b15cda7d744f30
-
Filesize
300.0MB
MD541d8a777ddc40a009a046f88900c0b80
SHA125dfd72ffe79eb5884d27fead86f4886bed638de
SHA256e6844a84f9210b5803147c158c841404331177bf409dab05fecb3b3303d50347
SHA512e75f3bfc85ed1def013474d61d5ee936ce36f499e0e111a7a1264180b7c7cc0b9a35469c35549e14c5efccc105db509aa5935152aab4e028b038e12b126f4514
-
Filesize
300.0MB
MD541d8a777ddc40a009a046f88900c0b80
SHA125dfd72ffe79eb5884d27fead86f4886bed638de
SHA256e6844a84f9210b5803147c158c841404331177bf409dab05fecb3b3303d50347
SHA512e75f3bfc85ed1def013474d61d5ee936ce36f499e0e111a7a1264180b7c7cc0b9a35469c35549e14c5efccc105db509aa5935152aab4e028b038e12b126f4514