Analysis
-
max time kernel
57s -
max time network
61s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2023 21:16
Behavioral task
behavioral1
Sample
stub.exe
Resource
win10v2004-20230220-en
General
-
Target
stub.exe
-
Size
3.8MB
-
MD5
8ee8f36cfddbb4aeb1388191cfca4e90
-
SHA1
742516898c7ba788f889c2a3438a37a354524577
-
SHA256
a1d460867b08cc04ecf499c53f72acd1ac2ae4a0d28ea72bdc2b7a8a0a99b704
-
SHA512
d84fdac4f0afb9e3e2eb13a14f4753e992ebadc00f1ad87bcf44a7fb41e38b282db7280d8fa9d9c829ce3a314688ca013566d57c3d3ec51c4a3f068e7e65c5b6
-
SSDEEP
98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/dmlwXVZ4FB:5+R/eZADUXR
Malware Config
Extracted
bitrat
1.38
soon-lp.at.ply.gg:17209
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
install_dir
C:\ProgramData
-
install_file
Bit
-
tor_process
tor
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
stub.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation stub.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
stub.exestub.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bit = "C:\\Users\\Admin\\AppData\\Local\\C:\\ProgramData\\Bit" stub.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bit = "C:\\Users\\Admin\\AppData\\Local\\C:\\ProgramData\\Bit먀" stub.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bit = "C:\\Users\\Admin\\AppData\\Local\\C:\\ProgramData\\Bit" stub.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
Processes:
stub.exestub.exepid process 952 stub.exe 952 stub.exe 952 stub.exe 952 stub.exe 952 stub.exe 4120 stub.exe 4120 stub.exe 4120 stub.exe 4120 stub.exe 4120 stub.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 10 IoCs
Processes:
stub.exestub.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\ms-settings\shell\open stub.exe Key deleted \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\ms-settings\shell stub.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\ms-settings\shell stub.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\ms-settings\shell\open stub.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\stub.exe -prs 952" stub.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\ms-settings\shell\open\command\DelegateExecute stub.exe Key deleted \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\ms-settings\shell\open\command stub.exe Key deleted \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\ms-settings stub.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\ms-settings\shell\open\command stub.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\ms-settings stub.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
stub.exestub.exedescription pid process Token: SeShutdownPrivilege 952 stub.exe Token: SeDebugPrivilege 4120 stub.exe Token: SeShutdownPrivilege 4120 stub.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
stub.exestub.exepid process 952 stub.exe 952 stub.exe 4120 stub.exe 4120 stub.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
stub.exefodhelper.exedescription pid process target process PID 952 wrote to memory of 2864 952 stub.exe fodhelper.exe PID 952 wrote to memory of 2864 952 stub.exe fodhelper.exe PID 2864 wrote to memory of 4120 2864 fodhelper.exe stub.exe PID 2864 wrote to memory of 4120 2864 fodhelper.exe stub.exe PID 2864 wrote to memory of 4120 2864 fodhelper.exe stub.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\stub.exe"C:\Users\Admin\AppData\Local\Temp\stub.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\stub.exe"C:\Users\Admin\AppData\Local\Temp\stub.exe" -prs 9523⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/952-133-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/952-134-0x00000000747C0000-0x00000000747F9000-memory.dmpFilesize
228KB
-
memory/952-135-0x0000000074B60000-0x0000000074B99000-memory.dmpFilesize
228KB
-
memory/4120-136-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4120-137-0x0000000074E50000-0x0000000074E89000-memory.dmpFilesize
228KB
-
memory/4120-138-0x0000000074B30000-0x0000000074B69000-memory.dmpFilesize
228KB