Analysis
-
max time kernel
115s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
17-03-2023 22:29
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe
Resource
win7-20230220-en
General
-
Target
SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe
-
Size
3.8MB
-
MD5
86000b0a976dc4a377b2e5192fe30445
-
SHA1
ad29b138883d7906f8d6e75f2e5f60e5285d4a56
-
SHA256
11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
-
SHA512
4d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
SSDEEP
98304:nUyJF2oYGCLxnJ7rzdIzYsuvqqW07LslsPTU:nUbn5zSzYhqqW0ns8U
Malware Config
Extracted
bitrat
1.38
74.201.28.92:3569
-
communication_password
148b191cf4e80b549e1b1a4444f2bdf6
-
tor_process
tor
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
wbnh.exewbnh.exewbnh.exewbnh.exepid process 1604 wbnh.exe 4816 wbnh.exe 1608 wbnh.exe 2144 wbnh.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.28471.2091.exewbnh.exewbnh.exedescription pid process target process PID 5088 set thread context of 1124 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 1604 set thread context of 4816 1604 wbnh.exe wbnh.exe PID 1608 set thread context of 2144 1608 wbnh.exe wbnh.exe -
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1604 1124 WerFault.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe 3472 4816 WerFault.exe wbnh.exe 4368 2144 WerFault.exe wbnh.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 4576 schtasks.exe 3580 schtasks.exe 4372 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.28471.2091.execmd.exewbnh.execmd.exewbnh.exedescription pid process target process PID 5088 wrote to memory of 1124 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 5088 wrote to memory of 1124 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 5088 wrote to memory of 1124 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 5088 wrote to memory of 1124 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 5088 wrote to memory of 1124 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 5088 wrote to memory of 1124 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 5088 wrote to memory of 1124 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 5088 wrote to memory of 1124 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 5088 wrote to memory of 1124 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 5088 wrote to memory of 1124 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 5088 wrote to memory of 1124 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 5088 wrote to memory of 1792 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 5088 wrote to memory of 1792 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 5088 wrote to memory of 1792 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 5088 wrote to memory of 4016 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 5088 wrote to memory of 4016 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 5088 wrote to memory of 4016 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 5088 wrote to memory of 4012 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 5088 wrote to memory of 4012 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 5088 wrote to memory of 4012 5088 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 4016 wrote to memory of 4576 4016 cmd.exe schtasks.exe PID 4016 wrote to memory of 4576 4016 cmd.exe schtasks.exe PID 4016 wrote to memory of 4576 4016 cmd.exe schtasks.exe PID 1604 wrote to memory of 4816 1604 wbnh.exe wbnh.exe PID 1604 wrote to memory of 4816 1604 wbnh.exe wbnh.exe PID 1604 wrote to memory of 4816 1604 wbnh.exe wbnh.exe PID 1604 wrote to memory of 4816 1604 wbnh.exe wbnh.exe PID 1604 wrote to memory of 4816 1604 wbnh.exe wbnh.exe PID 1604 wrote to memory of 4816 1604 wbnh.exe wbnh.exe PID 1604 wrote to memory of 4816 1604 wbnh.exe wbnh.exe PID 1604 wrote to memory of 4816 1604 wbnh.exe wbnh.exe PID 1604 wrote to memory of 4816 1604 wbnh.exe wbnh.exe PID 1604 wrote to memory of 4816 1604 wbnh.exe wbnh.exe PID 1604 wrote to memory of 4816 1604 wbnh.exe wbnh.exe PID 1604 wrote to memory of 1180 1604 wbnh.exe cmd.exe PID 1604 wrote to memory of 1180 1604 wbnh.exe cmd.exe PID 1604 wrote to memory of 1180 1604 wbnh.exe cmd.exe PID 1604 wrote to memory of 3616 1604 wbnh.exe cmd.exe PID 1604 wrote to memory of 3616 1604 wbnh.exe cmd.exe PID 1604 wrote to memory of 3616 1604 wbnh.exe cmd.exe PID 1604 wrote to memory of 1996 1604 wbnh.exe cmd.exe PID 1604 wrote to memory of 1996 1604 wbnh.exe cmd.exe PID 1604 wrote to memory of 1996 1604 wbnh.exe cmd.exe PID 3616 wrote to memory of 3580 3616 cmd.exe schtasks.exe PID 3616 wrote to memory of 3580 3616 cmd.exe schtasks.exe PID 3616 wrote to memory of 3580 3616 cmd.exe schtasks.exe PID 1608 wrote to memory of 2144 1608 wbnh.exe wbnh.exe PID 1608 wrote to memory of 2144 1608 wbnh.exe wbnh.exe PID 1608 wrote to memory of 2144 1608 wbnh.exe wbnh.exe PID 1608 wrote to memory of 2144 1608 wbnh.exe wbnh.exe PID 1608 wrote to memory of 2144 1608 wbnh.exe wbnh.exe PID 1608 wrote to memory of 2144 1608 wbnh.exe wbnh.exe PID 1608 wrote to memory of 2144 1608 wbnh.exe wbnh.exe PID 1608 wrote to memory of 2144 1608 wbnh.exe wbnh.exe PID 1608 wrote to memory of 2144 1608 wbnh.exe wbnh.exe PID 1608 wrote to memory of 2144 1608 wbnh.exe wbnh.exe PID 1608 wrote to memory of 2144 1608 wbnh.exe wbnh.exe PID 1608 wrote to memory of 3736 1608 wbnh.exe cmd.exe PID 1608 wrote to memory of 3736 1608 wbnh.exe cmd.exe PID 1608 wrote to memory of 3736 1608 wbnh.exe cmd.exe PID 1608 wrote to memory of 452 1608 wbnh.exe cmd.exe PID 1608 wrote to memory of 452 1608 wbnh.exe cmd.exe PID 1608 wrote to memory of 452 1608 wbnh.exe cmd.exe PID 1608 wrote to memory of 2592 1608 wbnh.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1883⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1124 -ip 11241⤵
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeC:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 1883⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4816 -ip 48161⤵
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeC:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 1883⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2144 -ip 21441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wbnh.exe.logFilesize
612B
MD54bc94363628f46b343c5e8e2da62ca26
SHA18a41ac46e24d790e11a407d0e957c4a6be6056c4
SHA256c8e1d0b306825b2c9a3ed32a461dd191ceb861205425fdfb687a4889684a3e1a
SHA512cf8ede5b84ba775d8ff89752530fa899d6b2e6424549202ab782a3caa92c0d9a31e9b2f660b51eedc932a68ba25e9ec228bb965cdc183e600ea8aa5a6736f829
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
memory/1124-137-0x0000000000670000-0x0000000000690000-memory.dmpFilesize
128KB
-
memory/1124-147-0x0000000000A30000-0x0000000000DFE000-memory.dmpFilesize
3.8MB
-
memory/1124-143-0x0000000000A30000-0x0000000000DFE000-memory.dmpFilesize
3.8MB
-
memory/1124-138-0x0000000000A30000-0x0000000000DFE000-memory.dmpFilesize
3.8MB
-
memory/1604-161-0x0000000005430000-0x0000000005440000-memory.dmpFilesize
64KB
-
memory/2144-172-0x0000000000960000-0x0000000000D2E000-memory.dmpFilesize
3.8MB
-
memory/2144-176-0x0000000000960000-0x0000000000D2E000-memory.dmpFilesize
3.8MB
-
memory/4816-157-0x0000000000C20000-0x0000000000FEE000-memory.dmpFilesize
3.8MB
-
memory/4816-162-0x0000000000C20000-0x0000000000FEE000-memory.dmpFilesize
3.8MB
-
memory/5088-133-0x00000000005D0000-0x00000000009A6000-memory.dmpFilesize
3.8MB
-
memory/5088-136-0x0000000005500000-0x0000000005510000-memory.dmpFilesize
64KB
-
memory/5088-135-0x0000000005310000-0x0000000005376000-memory.dmpFilesize
408KB
-
memory/5088-134-0x0000000005810000-0x0000000005DB4000-memory.dmpFilesize
5.6MB