Analysis Overview
SHA256
fc729002ac4f2ca65757920fe60351d318b329d854cbf709addf0761d0c68664
Threat Level: Known bad
The file 0e5fadebbb63160d78fab09972b795f7.exe was found to be: Known bad.
Malicious Activity Summary
BitRAT
Checks computer location settings
UPX packed file
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-02-11 09:36
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-02-11 09:36
Reported
2023-02-11 09:39
Platform
win7-20220812-en
Max time kernel
75s
Max time network
47s
Command Line
Signatures
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OHAxhhFlhLD.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OHAxhhFlhLD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp53F.tmp"
C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"
C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"
C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"
C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"
C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"
Network
Files
memory/668-54-0x00000000000E0000-0x00000000002F6000-memory.dmp
memory/668-55-0x0000000075981000-0x0000000075983000-memory.dmp
memory/668-56-0x00000000007A0000-0x00000000007B4000-memory.dmp
memory/668-57-0x0000000001F40000-0x0000000001F4C000-memory.dmp
memory/668-58-0x0000000008490000-0x0000000008664000-memory.dmp
memory/816-59-0x0000000000000000-mapping.dmp
memory/1684-61-0x0000000000000000-mapping.dmp
memory/676-62-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\tmp53F.tmp
| MD5 | 7e27a57ca0363b47c5a883cd84bd21b7 |
| SHA1 | 9f40f0b545ccabe599de4e1b580c7cc16d0f013c |
| SHA256 | 9e71bd2085431f14145f71c86be5f1920cceb8169780a6152eee0a774099681d |
| SHA512 | e14386e84ec40ed797543a83b0ea110c6c18877933ede0ad386957e11557e12ebaf5f24f60092cdec3bfb9f8550df5f869ec9a92a6b2db21738b6247a4cd46b9 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | 0822b979676e2929d9a2ac57523c8c7a |
| SHA1 | cd1e8e182a71941c7af8a2e722c037e716bb1a36 |
| SHA256 | 58d67692db6eb8fdaec532d5ae24c0a780873075964afe00fdd05964c1ade399 |
| SHA512 | 6b225a48dc7f5a510070fead877efc446c8f2cba520e5eaac142a8fb0780adbc4ab7cd1ef3b5fcea022e4c783ad4e4bcffb7e6f1bb92744a0b734e3c67a17d8b |
memory/668-66-0x0000000009D60000-0x0000000009EDA000-memory.dmp
memory/1684-67-0x000000006D120000-0x000000006D6CB000-memory.dmp
memory/816-68-0x000000006D120000-0x000000006D6CB000-memory.dmp
memory/1684-70-0x000000006D120000-0x000000006D6CB000-memory.dmp
memory/816-69-0x000000006D120000-0x000000006D6CB000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-02-11 09:36
Reported
2023-02-11 09:39
Platform
win10v2004-20221111-en
Max time kernel
149s
Max time network
153s
Command Line
Signatures
BitRAT
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4880 set thread context of 524 | N/A | C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe | C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OHAxhhFlhLD.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OHAxhhFlhLD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFFEB.tmp"
C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"
C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"
Network
| Country | Destination | Domain | Proto |
| US | 72.21.81.240:80 | tcp | |
| US | 20.42.73.24:443 | tcp | |
| NL | 104.80.225.205:443 | tcp | |
| US | 72.21.81.240:80 | tcp | |
| US | 72.21.81.240:80 | tcp | |
| US | 72.21.81.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| BG | 101.99.94.203:1234 | tcp | |
| NL | 8.238.177.126:80 | tcp | |
| NL | 8.238.177.126:80 | tcp |
Files
memory/4880-132-0x0000000000FE0000-0x00000000011F6000-memory.dmp
memory/4880-133-0x00000000061C0000-0x0000000006764000-memory.dmp
memory/4880-134-0x0000000005C10000-0x0000000005CA2000-memory.dmp
memory/4880-135-0x0000000005B90000-0x0000000005B9A000-memory.dmp
memory/4880-136-0x0000000009EB0000-0x0000000009F4C000-memory.dmp
memory/1144-137-0x0000000000000000-mapping.dmp
memory/3816-138-0x0000000000000000-mapping.dmp
memory/3644-139-0x0000000000000000-mapping.dmp
memory/1144-140-0x0000000002750000-0x0000000002786000-memory.dmp
memory/1144-141-0x00000000052B0000-0x00000000058D8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpFFEB.tmp
| MD5 | 9a53402bd346fdc2a36143ea42a1ae3a |
| SHA1 | 1ad4e9eec239834f340857da46ca9702ecb2cb87 |
| SHA256 | 377f16767d69cbc7e7b3395360f479ae4ad7184544aeb8012f9ece77e0208414 |
| SHA512 | daeadd9d6945a5c672353541039bc82fb572ddb952422a9e85b59558b7aaffd2a58486bcebee671e86cfe7f60f7c245d9adc0ad4880722f6e23dc9bef0df00b3 |
memory/3816-143-0x0000000004FF0000-0x0000000005012000-memory.dmp
memory/3816-144-0x0000000005210000-0x0000000005276000-memory.dmp
memory/1144-145-0x0000000005A10000-0x0000000005A76000-memory.dmp
memory/3540-146-0x0000000000000000-mapping.dmp
memory/524-147-0x0000000000000000-mapping.dmp
memory/524-148-0x0000000000400000-0x00000000007E4000-memory.dmp
memory/524-149-0x0000000000400000-0x00000000007E4000-memory.dmp
memory/524-150-0x0000000000400000-0x00000000007E4000-memory.dmp
memory/524-151-0x0000000000400000-0x00000000007E4000-memory.dmp
memory/524-153-0x0000000000400000-0x00000000007E4000-memory.dmp
memory/1144-152-0x0000000006040000-0x000000000605E000-memory.dmp
memory/524-154-0x0000000070C60000-0x0000000070C99000-memory.dmp
memory/1144-155-0x0000000007040000-0x0000000007072000-memory.dmp
memory/3816-157-0x0000000075080000-0x00000000750CC000-memory.dmp
memory/1144-156-0x0000000075080000-0x00000000750CC000-memory.dmp
memory/1144-158-0x00000000065F0000-0x000000000660E000-memory.dmp
memory/524-159-0x0000000070BC0000-0x0000000070BF9000-memory.dmp
memory/3816-160-0x00000000073F0000-0x000000000740A000-memory.dmp
memory/1144-161-0x00000000079B0000-0x000000000802A000-memory.dmp
memory/3816-162-0x0000000007460000-0x000000000746A000-memory.dmp
memory/524-163-0x0000000000400000-0x00000000007E4000-memory.dmp
memory/3816-164-0x0000000007670000-0x0000000007706000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |