bitrat | 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a

General

Target

1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe
Size

3.8MB
MD5

d07b7112b39c9eee7eaeba1adb099543
SHA1

1df70cc161540228240e1dde290ac2f5efcfbb0c
SHA256

1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a
SHA512

9f82564e59b49e503de3aad4b7a28a163b3de543a807522c48c5b6f3a005cb38b37e99fab6865e0e064be9c1cf6e2cbec616e7cbb2218ea9f1fbd2015ef9e135
SSDEEP

98304:cCtEONaf1kMdpRfZJDRJwdaUNa8gPgEICG6x098gJ2uCB9Ml:RE0UkkHRJuNawLCG6x+8gJFm

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

74.201.28.92:3569

Attributes

communication_password
148b191cf4e80b549e1b1a4444f2bdf6
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Executes dropped EXE 3 IoCs

Processes:

tewu.exetewu.exetewu.exe

pid process

1828 tewu.exe
5064 tewu.exe
5036 tewu.exe

pid	process
1828	tewu.exe
5064	tewu.exe
5036	tewu.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/4728-201-0x0000000000400000-0x00000000008DC000-memory.dmp	upx
behavioral1/memory/4728-203-0x0000000000400000-0x00000000008DC000-memory.dmp	upx
behavioral1/memory/4728-204-0x0000000000400000-0x00000000008DC000-memory.dmp	upx
behavioral1/memory/4728-212-0x0000000000400000-0x00000000008DC000-memory.dmp	upx
behavioral1/memory/4728-252-0x0000000000400000-0x00000000008DC000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{C6D7CAF7-DC0C-4392-A99E-83A5F2564E27}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{17D79073-5B8B-4C14-9D99-6447704544B9}.catalogItem	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

Processes:

vbc.exevbc.exevbc.exe

pid process

4588 vbc.exe
4588 vbc.exe
4588 vbc.exe
4588 vbc.exe
4588 vbc.exe
4416 vbc.exe
3256 vbc.exe

pid	process
4588	vbc.exe
4588	vbc.exe
4588	vbc.exe
4588	vbc.exe
4588	vbc.exe
4416	vbc.exe
3256	vbc.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exetewu.exevbc.exetewu.exetewu.exe

description	pid	process	target process
PID 2308 set thread context of 4588	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	vbc.exe
PID 1828 set thread context of 4416	1828	tewu.exe	vbc.exe
PID 4588 set thread context of 4728	4588	vbc.exe	vbc.exe
PID 5064 set thread context of 2024	5064	tewu.exe	vbc.exe
PID 5036 set thread context of 3256	5036	tewu.exe	vbc.exe

Drops file in Windows directory 25 IoCs

Processes:

vbc.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-filesystem-l1-1-0.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\mozglue.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\msvcp140.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\nss3.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\softokn3.dll	vbc.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\License.XenArmor	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-conio-l1-1-0_not.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-heap-l1-1-0.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-locale-l1-1-0.dll	vbc.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt	vbc.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\License.XenArmor	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-stdio-l1-1-0.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-time-l1-1-0.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\freebl3.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Unknown.dll	vbc.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Unknown.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-environment-l1-1-0.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-multibyte-l1-1-0.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-runtime-l1-1-0.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-string-l1-1-0.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-utility-l1-1-0.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\vcruntime140.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-convert-l1-1-0.dll	vbc.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-math-l1-1-0.dll	vbc.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1436 2024 WerFault.exe vbc.exe

pid	pid_target	process	target process
1436	2024	WerFault.exe	vbc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4596 schtasks.exe
4412 schtasks.exe
3864 schtasks.exe
4036 schtasks.exe

pid	process
4596	schtasks.exe
4412	schtasks.exe
3864	schtasks.exe
4036	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vbc.exevbc.exevbc.exe

description pid process

Token: SeShutdownPrivilege 4588 vbc.exe
Token: SeShutdownPrivilege 4416 vbc.exe
Token: SeShutdownPrivilege 3256 vbc.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

vbc.exe

pid process

4588 vbc.exe
4588 vbc.exe

description	pid	process
Token: SeShutdownPrivilege	4588	vbc.exe
Token: SeShutdownPrivilege	4416	vbc.exe
Token: SeShutdownPrivilege	3256	vbc.exe

pid	process
4588	vbc.exe
4588	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.execmd.exetewu.execmd.exevbc.exevbc.exetewu.exe

description	pid	process	target process
PID 2308 wrote to memory of 4588	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	vbc.exe
PID 2308 wrote to memory of 4588	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	vbc.exe
PID 2308 wrote to memory of 4588	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	vbc.exe
PID 2308 wrote to memory of 4588	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	vbc.exe
PID 2308 wrote to memory of 4588	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	vbc.exe
PID 2308 wrote to memory of 4588	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	vbc.exe
PID 2308 wrote to memory of 4588	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	vbc.exe
PID 2308 wrote to memory of 4588	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	vbc.exe
PID 2308 wrote to memory of 4588	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	vbc.exe
PID 2308 wrote to memory of 4588	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	vbc.exe
PID 2308 wrote to memory of 4588	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	vbc.exe
PID 2308 wrote to memory of 4284	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	cmd.exe
PID 2308 wrote to memory of 4284	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	cmd.exe
PID 2308 wrote to memory of 4284	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	cmd.exe
PID 2308 wrote to memory of 4344	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	cmd.exe
PID 2308 wrote to memory of 4344	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	cmd.exe
PID 2308 wrote to memory of 4344	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	cmd.exe
PID 2308 wrote to memory of 1572	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	cmd.exe
PID 2308 wrote to memory of 1572	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	cmd.exe
PID 2308 wrote to memory of 1572	2308	1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe	cmd.exe
PID 4344 wrote to memory of 4596	4344	cmd.exe	schtasks.exe
PID 4344 wrote to memory of 4596	4344	cmd.exe	schtasks.exe
PID 4344 wrote to memory of 4596	4344	cmd.exe	schtasks.exe
PID 1828 wrote to memory of 4416	1828	tewu.exe	vbc.exe
PID 1828 wrote to memory of 4416	1828	tewu.exe	vbc.exe
PID 1828 wrote to memory of 4416	1828	tewu.exe	vbc.exe
PID 1828 wrote to memory of 4416	1828	tewu.exe	vbc.exe
PID 1828 wrote to memory of 4416	1828	tewu.exe	vbc.exe
PID 1828 wrote to memory of 4416	1828	tewu.exe	vbc.exe
PID 1828 wrote to memory of 4416	1828	tewu.exe	vbc.exe
PID 1828 wrote to memory of 4416	1828	tewu.exe	vbc.exe
PID 1828 wrote to memory of 4416	1828	tewu.exe	vbc.exe
PID 1828 wrote to memory of 4416	1828	tewu.exe	vbc.exe
PID 1828 wrote to memory of 4416	1828	tewu.exe	vbc.exe
PID 1828 wrote to memory of 4404	1828	tewu.exe	cmd.exe
PID 1828 wrote to memory of 4404	1828	tewu.exe	cmd.exe
PID 1828 wrote to memory of 4404	1828	tewu.exe	cmd.exe
PID 1828 wrote to memory of 2052	1828	tewu.exe	cmd.exe
PID 1828 wrote to memory of 2052	1828	tewu.exe	cmd.exe
PID 1828 wrote to memory of 2052	1828	tewu.exe	cmd.exe
PID 1828 wrote to memory of 4560	1828	tewu.exe	cmd.exe
PID 1828 wrote to memory of 4560	1828	tewu.exe	cmd.exe
PID 1828 wrote to memory of 4560	1828	tewu.exe	cmd.exe
PID 2052 wrote to memory of 4412	2052	cmd.exe	schtasks.exe
PID 2052 wrote to memory of 4412	2052	cmd.exe	schtasks.exe
PID 2052 wrote to memory of 4412	2052	cmd.exe	schtasks.exe
PID 4588 wrote to memory of 4728	4588	vbc.exe	vbc.exe
PID 4588 wrote to memory of 4728	4588	vbc.exe	vbc.exe
PID 4588 wrote to memory of 4728	4588	vbc.exe	vbc.exe
PID 4588 wrote to memory of 4728	4588	vbc.exe	vbc.exe
PID 4588 wrote to memory of 4728	4588	vbc.exe	vbc.exe
PID 4588 wrote to memory of 4728	4588	vbc.exe	vbc.exe
PID 4588 wrote to memory of 4728	4588	vbc.exe	vbc.exe
PID 4588 wrote to memory of 4728	4588	vbc.exe	vbc.exe
PID 4728 wrote to memory of 2040	4728	vbc.exe	vbc.exe
PID 4728 wrote to memory of 2040	4728	vbc.exe	vbc.exe
PID 4728 wrote to memory of 2040	4728	vbc.exe	vbc.exe
PID 5064 wrote to memory of 2024	5064	tewu.exe	vbc.exe
PID 5064 wrote to memory of 2024	5064	tewu.exe	vbc.exe
PID 5064 wrote to memory of 2024	5064	tewu.exe	vbc.exe
PID 5064 wrote to memory of 2024	5064	tewu.exe	vbc.exe
PID 5064 wrote to memory of 2024	5064	tewu.exe	vbc.exe
PID 5064 wrote to memory of 2024	5064	tewu.exe	vbc.exe
PID 5064 wrote to memory of 2024	5064	tewu.exe	vbc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe
"C:\Users\Admin\AppData\Local\Temp\1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
-a "C:\Users\Admin\AppData\Local\1868f947\plg\fF1fTYIM.json"
3⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4728

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
-a "C:\Users\Admin\AppData\Local\Temp\unk.xml"
4⤵
PID:2040

C:\Windows\SysWOW64\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\tewu"
2⤵
PID:4284

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:4344

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f
3⤵
- Creates scheduled task(s)
PID:4596

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe" "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe"
2⤵
PID:1572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4440

C:\Users\Admin\AppData\Roaming\tewu\tewu.exe
C:\Users\Admin\AppData\Roaming\tewu\tewu.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Windows\SysWOW64\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\tewu"
2⤵
PID:4404

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:2052

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f
3⤵
- Creates scheduled task(s)
PID:4412

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe" "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe"
2⤵
PID:4560

C:\Users\Admin\AppData\Roaming\tewu\tewu.exe
C:\Users\Admin\AppData\Roaming\tewu\tewu.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 188
3⤵
- Program crash
PID:1436

C:\Windows\SysWOW64\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\tewu"
2⤵
PID:2120

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f
2⤵
PID:568

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f
3⤵
- Creates scheduled task(s)
PID:3864

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe" "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe"
2⤵
PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2024 -ip 2024
1⤵
PID:4868

C:\Users\Admin\AppData\Roaming\tewu\tewu.exe
C:\Users\Admin\AppData\Roaming\tewu\tewu.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5036

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Windows\SysWOW64\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\tewu"
2⤵
PID:1656

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f
2⤵
PID:2656

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f
3⤵
- Creates scheduled task(s)
PID:4036

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe" "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe"
2⤵
PID:3808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\1868f947\plg\fF1fTYIM.json
Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tewu.exe.log
Filesize
517B

MD5
13f84b613e6a4dd2d82f7c44b2295a04

SHA1
f9e07213c2825ecb28e732f3e66e07625747c4b3

SHA256
d9c52c1eb0b6a04d3495ab971da2c6d01b0964a8b04fd173bfb351820b255c33

SHA512
3a2aca3d21bff43e36de5d9c97b0d1a9c972ee5ab0d9322a3615c0820042a7c9c4c0f2d41522fb4f2347b9a1679b63c91dcf5dc75444ba64c736e2cdcf10ee7d

Download Submit
C:\Users\Admin\AppData\Roaming\tewu\tewu.exe
Filesize
3.8MB

MD5
d07b7112b39c9eee7eaeba1adb099543

SHA1
1df70cc161540228240e1dde290ac2f5efcfbb0c

SHA256
1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a

SHA512
9f82564e59b49e503de3aad4b7a28a163b3de543a807522c48c5b6f3a005cb38b37e99fab6865e0e064be9c1cf6e2cbec616e7cbb2218ea9f1fbd2015ef9e135

Download Submit
C:\Users\Admin\AppData\Roaming\tewu\tewu.exe
Filesize
3.8MB

MD5
d07b7112b39c9eee7eaeba1adb099543

SHA1
1df70cc161540228240e1dde290ac2f5efcfbb0c

SHA256
1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a

SHA512
9f82564e59b49e503de3aad4b7a28a163b3de543a807522c48c5b6f3a005cb38b37e99fab6865e0e064be9c1cf6e2cbec616e7cbb2218ea9f1fbd2015ef9e135

Download Submit
C:\Users\Admin\AppData\Roaming\tewu\tewu.exe
Filesize
3.8MB

MD5
d07b7112b39c9eee7eaeba1adb099543

SHA1
1df70cc161540228240e1dde290ac2f5efcfbb0c

SHA256
1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a

SHA512
9f82564e59b49e503de3aad4b7a28a163b3de543a807522c48c5b6f3a005cb38b37e99fab6865e0e064be9c1cf6e2cbec616e7cbb2218ea9f1fbd2015ef9e135

Download Submit
C:\Users\Admin\AppData\Roaming\tewu\tewu.exe
Filesize
3.8MB

MD5
d07b7112b39c9eee7eaeba1adb099543

SHA1
1df70cc161540228240e1dde290ac2f5efcfbb0c

SHA256
1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a

SHA512
9f82564e59b49e503de3aad4b7a28a163b3de543a807522c48c5b6f3a005cb38b37e99fab6865e0e064be9c1cf6e2cbec616e7cbb2218ea9f1fbd2015ef9e135

Download Submit
memory/2308-140-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download
memory/2308-133-0x0000000000910000-0x0000000000CE4000-memory.dmp

Filesize
3.8MB

Download
memory/2308-135-0x0000000005620000-0x0000000005686000-memory.dmp

Filesize
408KB

Download
memory/3256-313-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/3256-316-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4416-183-0x00000000746B0000-0x00000000746E9000-memory.dmp

Filesize
228KB

Download
memory/4416-182-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4416-174-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4416-172-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4416-171-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-184-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-193-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-157-0x0000000074920000-0x0000000074959000-memory.dmp

Filesize
228KB

Download
memory/4588-164-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-155-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-154-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-153-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-150-0x00000000745A0000-0x00000000745D9000-memory.dmp

Filesize
228KB

Download
memory/4588-152-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-175-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-176-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-177-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-178-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-179-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-151-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-149-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-147-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-185-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-186-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-187-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-188-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-189-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-190-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-191-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-192-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-156-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-194-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-198-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-137-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-138-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-139-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-287-0x0000000074920000-0x0000000074959000-memory.dmp

Filesize
228KB

Download
memory/4588-286-0x00000000745A0000-0x00000000745D9000-memory.dmp

Filesize
228KB

Download
memory/4588-253-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-256-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-148-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-257-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-258-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-260-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-263-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-267-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-146-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4588-142-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4728-252-0x0000000000400000-0x00000000008DC000-memory.dmp

Filesize
4.9MB

Download
memory/4728-212-0x0000000000400000-0x00000000008DC000-memory.dmp

Filesize
4.9MB

Download
memory/4728-204-0x0000000000400000-0x00000000008DC000-memory.dmp

Filesize
4.9MB

Download
memory/4728-203-0x0000000000400000-0x00000000008DC000-memory.dmp

Filesize
4.9MB

Download
memory/4728-201-0x0000000000400000-0x00000000008DC000-memory.dmp

Filesize
4.9MB

Download
memory/5036-312-0x0000000005130000-0x0000000005140000-memory.dmp

Filesize
64KB

Download
memory/5064-276-0x0000000005910000-0x0000000005920000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads