Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2023 18:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe
Resource
win7-20230831-en
10 signatures
150 seconds
General
-
Target
54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe
-
Size
967KB
-
MD5
29e932d3d12d1811d99691acb7f228bc
-
SHA1
4c67dd3dbb393ba68e602ed43223001bb88d94e4
-
SHA256
54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711
-
SHA512
39d2e21c86b5fd3bac702837f7c95ffe6a0119f9647998e0496a14a6c1f0f81f65fc331977ea16bc4a041d000d80942aa374538c9f9016e6e59f9eac01cdf98f
-
SSDEEP
24576:BqDEvCTbMWu7rQYlBQcBiT6rprG8aNrpmD:BTvC/MTQYxsWR7aNo
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
xwm.dynuddns.com:8889
Attributes
-
communication_password
cba52b50d9cf77a308a6bedcd075f95e
-
tor_process
tor
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 46 2120 cmd.exe 48 2120 cmd.exe 53 2120 cmd.exe -
resource yara_rule behavioral2/memory/2120-21-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-22-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-23-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-24-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-25-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3312-31-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-33-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1352-37-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-39-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-40-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-41-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-42-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-44-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-45-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-47-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3312-51-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3312-53-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1352-54-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-56-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1352-55-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1760-58-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1760-60-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-61-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-62-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-64-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-65-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 3312 cmd.exe 1352 cmd.exe 1760 cmd.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 5056 set thread context of 2120 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 86 PID 5056 set thread context of 1100 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 87 PID 5056 set thread context of 3312 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 91 PID 5056 set thread context of 1352 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 92 PID 5056 set thread context of 1760 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 93 -
Program crash 1 IoCs
pid pid_target Process procid_target 2396 1100 WerFault.exe 87 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 2120 cmd.exe Token: SeShutdownPrivilege 3312 cmd.exe Token: SeShutdownPrivilege 1352 cmd.exe Token: SeShutdownPrivilege 1760 cmd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2120 cmd.exe 2120 cmd.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 5056 wrote to memory of 2120 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 86 PID 5056 wrote to memory of 2120 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 86 PID 5056 wrote to memory of 2120 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 86 PID 5056 wrote to memory of 2120 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 86 PID 5056 wrote to memory of 2120 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 86 PID 5056 wrote to memory of 2120 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 86 PID 5056 wrote to memory of 2120 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 86 PID 5056 wrote to memory of 2120 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 86 PID 5056 wrote to memory of 1100 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 87 PID 5056 wrote to memory of 1100 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 87 PID 5056 wrote to memory of 1100 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 87 PID 5056 wrote to memory of 1100 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 87 PID 5056 wrote to memory of 3312 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 91 PID 5056 wrote to memory of 3312 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 91 PID 5056 wrote to memory of 3312 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 91 PID 5056 wrote to memory of 3312 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 91 PID 5056 wrote to memory of 3312 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 91 PID 5056 wrote to memory of 3312 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 91 PID 5056 wrote to memory of 3312 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 91 PID 5056 wrote to memory of 3312 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 91 PID 5056 wrote to memory of 1352 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 92 PID 5056 wrote to memory of 1352 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 92 PID 5056 wrote to memory of 1352 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 92 PID 5056 wrote to memory of 1352 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 92 PID 5056 wrote to memory of 1352 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 92 PID 5056 wrote to memory of 1352 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 92 PID 5056 wrote to memory of 1352 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 92 PID 5056 wrote to memory of 1352 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 92 PID 5056 wrote to memory of 1760 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 93 PID 5056 wrote to memory of 1760 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 93 PID 5056 wrote to memory of 1760 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 93 PID 5056 wrote to memory of 1760 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 93 PID 5056 wrote to memory of 1760 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 93 PID 5056 wrote to memory of 1760 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 93 PID 5056 wrote to memory of 1760 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 93 PID 5056 wrote to memory of 1760 5056 54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe"C:\Users\Admin\AppData\Local\Temp\54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2120
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵PID:1100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 803⤵
- Program crash
PID:2396
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3312
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1352
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1100 -ip 11001⤵PID:2276