bitrat | hxxp://45[.]95[.]169[.]45[:]23205/

General

Target

http://45.95.169.45:23205/

Score

10^/10

bitrat persistence trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

45.95.168.128:23202

Attributes

communication_password
ed99c23d77796aac877ce1f91481dc28
install_dir
Oracle
install_file
java.exe
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

sli.exeservi.exetst.exe

pid process

2380 sli.exe
3668 servi.exe
5028 tst.exe

pid	process
2380	sli.exe
3668	servi.exe
5028	tst.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\tst.exe	upx
C:\Users\Admin\Downloads\tst.exe	upx
behavioral1/memory/5028-144-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/5028-148-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

tst.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Local\\Oracle\\java.exe먀"	tst.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Local\\Oracle\\java.exe瘀"	tst.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Local\\Oracle\\java.exe"	tst.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Local\\Oracle\\java.exe준"	tst.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

tst.exe

pid process

5028 tst.exe
5028 tst.exe
5028 tst.exe
5028 tst.exe

pid	process
5028	tst.exe
5028	tst.exe
5028	tst.exe
5028	tst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	process
1888	chrome.exe
1888	chrome.exe
4648	chrome.exe
4648	chrome.exe
3092	chrome.exe
3092	chrome.exe
4276	chrome.exe
4276	chrome.exe
2640	chrome.exe
2640	chrome.exe
4528	chrome.exe
4528	chrome.exe
3708	chrome.exe
3708	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
3236	chrome.exe
3236	chrome.exe
4892	chrome.exe
4892	chrome.exe
2596	chrome.exe
2596	chrome.exe
4464	chrome.exe
4464	chrome.exe
4824	chrome.exe
4824	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

4648 chrome.exe
4648 chrome.exe
4648 chrome.exe
4648 chrome.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tst.exe

description pid process

Token: SeShutdownPrivilege 5028 tst.exe

description	pid	process
Token: SeShutdownPrivilege	5028	tst.exe

Suspicious use of FindShellTrayWindow 56 IoCs

Processes:

chrome.exe

pid	process
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe
4648	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

tst.exe

pid process

5028 tst.exe
5028 tst.exe

pid	process
5028	tst.exe
5028	tst.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4648 wrote to memory of 4704	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4704	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4616	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 1888	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 1888	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe
PID 4648 wrote to memory of 4240	4648	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" http://45.95.169.45:23205/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9072e4f50,0x7ff9072e4f60,0x7ff9072e4f70
2⤵
PID:4704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1676 /prefetch:2
2⤵
PID:4616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2020 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2300 /prefetch:8
2⤵
PID:4240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:1
2⤵
PID:2240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
2⤵
PID:4876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4356 /prefetch:8
2⤵
PID:4372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4972 /prefetch:8
2⤵
PID:2676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4600 /prefetch:8
2⤵
PID:3648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5116 /prefetch:8
2⤵
PID:4464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4560 /prefetch:8
2⤵
PID:4968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
2⤵
PID:2404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
2⤵
PID:2740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
2⤵
PID:4488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5244 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4932 /prefetch:8
2⤵
PID:388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5176 /prefetch:8
2⤵
PID:936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4984 /prefetch:8
2⤵
PID:5032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3012 /prefetch:8
2⤵
PID:4900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3012 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2596

C:\Users\Admin\Downloads\sli.exe
"C:\Users\Admin\Downloads\sli.exe"
2⤵
- Executes dropped EXE
PID:2380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3116 /prefetch:8
2⤵
PID:1600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5024 /prefetch:8
2⤵
PID:3304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5384 /prefetch:8
2⤵
PID:5064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2124 /prefetch:8
2⤵
PID:2404

C:\Users\Admin\Downloads\servi.exe
"C:\Users\Admin\Downloads\servi.exe"
2⤵
- Executes dropped EXE
PID:3668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5160 /prefetch:8
2⤵
PID:4232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5472 /prefetch:8
2⤵
PID:2640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4532 /prefetch:8
2⤵
PID:3380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4364 /prefetch:8
2⤵
PID:4204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4652 /prefetch:8
2⤵
PID:2200

C:\Users\Admin\Downloads\tst.exe
"C:\Users\Admin\Downloads\tst.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,14207317243165060060,16807495558318485985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4828 /prefetch:8
2⤵
PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\Downloads\servi.exe

Filesize
7KB

MD5
c73ce9237ea8bdee32f9174496cdcbb0

SHA1
0eee0b40dea781b6506c4cd9881fc7f1997e1efa

SHA256
051bf8781fa9b71dce2d7b58c357d8f54ff497eb148c6bbc31ad7b0e13e4ed4d

SHA512
d02a4559d637a367a9fd1adb964977e8fd7ef2064235fd026c1a6c8231813096f1f4907e1046bffae1be7a5f662114d0272ad194c6f76db471adcd8c486ef4fe

Download Submit
C:\Users\Admin\Downloads\servi.exe

Filesize
7KB

MD5
c73ce9237ea8bdee32f9174496cdcbb0

SHA1
0eee0b40dea781b6506c4cd9881fc7f1997e1efa

SHA256
051bf8781fa9b71dce2d7b58c357d8f54ff497eb148c6bbc31ad7b0e13e4ed4d

SHA512
d02a4559d637a367a9fd1adb964977e8fd7ef2064235fd026c1a6c8231813096f1f4907e1046bffae1be7a5f662114d0272ad194c6f76db471adcd8c486ef4fe

Download Submit
C:\Users\Admin\Downloads\sli.exe

Filesize
12.1MB

MD5
6b6565acdfc8f94d04f221c07a6eca3d

SHA1
8a97f4017413c5c9b3ea764147d30584e8bf1836

SHA256
01669a6e5d52977c627eb66aa56317c108fee956a875a88ed09f3dd96e7f20a9

SHA512
ca67648b3ba5d02a9b8c91279704bf451221ddf0af46b5ed86084738fc07d0dc133a00a61f9851ea457b37ee13f40c4c06e2b136c176646431a910b93a969702

Download Submit
C:\Users\Admin\Downloads\sli.exe

Filesize
12.1MB

MD5
6b6565acdfc8f94d04f221c07a6eca3d

SHA1
8a97f4017413c5c9b3ea764147d30584e8bf1836

SHA256
01669a6e5d52977c627eb66aa56317c108fee956a875a88ed09f3dd96e7f20a9

SHA512
ca67648b3ba5d02a9b8c91279704bf451221ddf0af46b5ed86084738fc07d0dc133a00a61f9851ea457b37ee13f40c4c06e2b136c176646431a910b93a969702

Download Submit
C:\Users\Admin\Downloads\tst.exe

Filesize
1.4MB

MD5
3412592c23a9bc93a234c5e25130a71a

SHA1
cad0b43ff636a6d6dbbfbd38e134aa0acda7b052

SHA256
017ab0c10991b0d3faa2b6fdc43487632418c4f5a337e94f8490233d254ba566

SHA512
2076c9ebf616986a5e7a309bc105639abaf1ece7fcc69585457026371353aca82377f70f2903340ed28f40b69f9314c925f2319431d05b0ea527ab4ce0bd75a3

Download Submit
C:\Users\Admin\Downloads\tst.exe

Filesize
1.4MB

MD5
3412592c23a9bc93a234c5e25130a71a

SHA1
cad0b43ff636a6d6dbbfbd38e134aa0acda7b052

SHA256
017ab0c10991b0d3faa2b6fdc43487632418c4f5a337e94f8490233d254ba566

SHA512
2076c9ebf616986a5e7a309bc105639abaf1ece7fcc69585457026371353aca82377f70f2903340ed28f40b69f9314c925f2319431d05b0ea527ab4ce0bd75a3

Download Submit
\??\pipe\crashpad_4648_DKDLVATSLBDTBPAH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2380-134-0x0000000000000000-mapping.dmp

Download
memory/3668-137-0x0000000000000000-mapping.dmp

Download
memory/3668-140-0x0000000140000000-0x0000000140004318-memory.dmp

Filesize
16KB

Download
memory/5028-146-0x0000000074950000-0x0000000074989000-memory.dmp

Filesize
228KB

Download
memory/5028-152-0x0000000074950000-0x0000000074989000-memory.dmp

Filesize
228KB

Download
memory/5028-145-0x0000000074C90000-0x0000000074CC9000-memory.dmp

Filesize
228KB

Download
memory/5028-141-0x0000000000000000-mapping.dmp

Download
memory/5028-147-0x0000000074950000-0x0000000074989000-memory.dmp

Filesize
228KB

Download
memory/5028-148-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5028-149-0x0000000074950000-0x0000000074989000-memory.dmp

Filesize
228KB

Download
memory/5028-150-0x0000000074950000-0x0000000074989000-memory.dmp

Filesize
228KB

Download
memory/5028-151-0x0000000074950000-0x0000000074989000-memory.dmp

Filesize
228KB

Download
memory/5028-144-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5028-153-0x0000000074C90000-0x0000000074CC9000-memory.dmp

Filesize
228KB

Download
memory/5028-154-0x0000000074950000-0x0000000074989000-memory.dmp

Filesize
228KB

Download
memory/5028-155-0x0000000074950000-0x0000000074989000-memory.dmp

Filesize
228KB

Download
memory/5028-156-0x0000000074950000-0x0000000074989000-memory.dmp

Filesize
228KB

Download
memory/5028-157-0x0000000074950000-0x0000000074989000-memory.dmp

Filesize
228KB

Download
memory/5028-158-0x0000000074950000-0x0000000074989000-memory.dmp

Filesize
228KB

Download
memory/5028-159-0x0000000074950000-0x0000000074989000-memory.dmp

Filesize
228KB

Download
memory/5028-160-0x0000000074950000-0x0000000074989000-memory.dmp

Filesize
228KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads