Analysis Overview
SHA256
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
Threat Level: Known bad
The file ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8 was found to be: Known bad.
Malicious Activity Summary
BitRAT
Executes dropped EXE
Suspicious use of SetThreadContext
Program crash
Unsigned PE
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-09-19 16:03
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-09-19 16:03
Reported
2023-09-19 16:05
Platform
win10-20230915-en
Max time kernel
126s
Max time network
133s
Command Line
Signatures
BitRAT
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\state\state.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\state\state.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\state\state.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\state\state.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3384 set thread context of 2716 | N/A | C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe | C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe |
| PID 4072 set thread context of 4756 | N/A | C:\Users\Admin\AppData\Roaming\state\state.exe | C:\Users\Admin\AppData\Roaming\state\state.exe |
| PID 4992 set thread context of 4844 | N/A | C:\Users\Admin\AppData\Roaming\state\state.exe | C:\Users\Admin\AppData\Roaming\state\state.exe |
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe
"C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe"
C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe
"C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe"
C:\Windows\SysWOW64\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\state"
C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe" "C:\Users\Admin\AppData\Roaming\state\state.exe"
C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 196
C:\Users\Admin\AppData\Roaming\state\state.exe
C:\Users\Admin\AppData\Roaming\state\state.exe
C:\Users\Admin\AppData\Roaming\state\state.exe
"C:\Users\Admin\AppData\Roaming\state\state.exe"
C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\state\state.exe" "C:\Users\Admin\AppData\Roaming\state\state.exe"
C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f
C:\Windows\SysWOW64\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\state"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 180
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f
C:\Users\Admin\AppData\Roaming\state\state.exe
C:\Users\Admin\AppData\Roaming\state\state.exe
C:\Users\Admin\AppData\Roaming\state\state.exe
"C:\Users\Admin\AppData\Roaming\state\state.exe"
C:\Windows\SysWOW64\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\state"
C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f
C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\state\state.exe" "C:\Users\Admin\AppData\Roaming\state\state.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 180
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa | udp |
| US | 8.8.8.8:53 | 105.134.101.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 135.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.173.189.20.in-addr.arpa | udp |
Files
memory/3384-0-0x0000000073320000-0x0000000073A0E000-memory.dmp
memory/3384-1-0x0000000000FA0000-0x000000000173E000-memory.dmp
memory/3384-2-0x00000000065B0000-0x0000000006AAE000-memory.dmp
memory/3384-3-0x00000000060A0000-0x00000000060B0000-memory.dmp
memory/3384-4-0x0000000007AB0000-0x000000000823A000-memory.dmp
memory/2716-5-0x0000000000E30000-0x00000000011FE000-memory.dmp
memory/3384-9-0x0000000073320000-0x0000000073A0E000-memory.dmp
memory/2716-11-0x0000000000E30000-0x00000000011FE000-memory.dmp
memory/2716-15-0x0000000000E30000-0x00000000011FE000-memory.dmp
C:\Users\Admin\AppData\Roaming\state\state.exe
| MD5 | 18e07c4772a2687ee06a434ffef9572f |
| SHA1 | ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe |
| SHA256 | ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8 |
| SHA512 | 8795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b |
C:\Users\Admin\AppData\Roaming\state\state.exe
| MD5 | 18e07c4772a2687ee06a434ffef9572f |
| SHA1 | ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe |
| SHA256 | ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8 |
| SHA512 | 8795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b |
memory/4072-20-0x0000000072640000-0x0000000072D2E000-memory.dmp
memory/4072-21-0x00000000056A0000-0x00000000056B0000-memory.dmp
C:\Users\Admin\AppData\Roaming\state\state.exe
| MD5 | 18e07c4772a2687ee06a434ffef9572f |
| SHA1 | ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe |
| SHA256 | ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8 |
| SHA512 | 8795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b |
memory/4756-28-0x0000000001000000-0x00000000013CE000-memory.dmp
memory/4072-30-0x0000000072640000-0x0000000072D2E000-memory.dmp
memory/4756-33-0x0000000001000000-0x00000000013CE000-memory.dmp
C:\Users\Admin\AppData\Roaming\state\state.exe
| MD5 | 18e07c4772a2687ee06a434ffef9572f |
| SHA1 | ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe |
| SHA256 | ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8 |
| SHA512 | 8795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\state.exe.log
| MD5 | 807cb75397a3a9fc38e9fb5f8566eb2d |
| SHA1 | 367e151fab5a5a80e60202d287ae522ea53e2563 |
| SHA256 | 3e5056b73303b361e6b7b52f5edb2ed1a7e9dc2c762bb91d18046f42bc2ffcf3 |
| SHA512 | 49efef0401ba0e0dc0b30bdff5d414da5494e4194c6269da2cb40b1ab7dc53e7858d29d2b9982bf3ee60ebc9638b5ed2b5ddcbb536bcc57729e79fc81f59f13d |
memory/4992-36-0x00000000726E0000-0x0000000072DCE000-memory.dmp
memory/4992-37-0x0000000005810000-0x0000000005820000-memory.dmp
C:\Users\Admin\AppData\Roaming\state\state.exe
| MD5 | 18e07c4772a2687ee06a434ffef9572f |
| SHA1 | ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe |
| SHA256 | ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8 |
| SHA512 | 8795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b |
memory/4844-43-0x0000000000DC0000-0x000000000118E000-memory.dmp
memory/4992-47-0x00000000726E0000-0x0000000072DCE000-memory.dmp
memory/4844-48-0x0000000000DC0000-0x000000000118E000-memory.dmp