Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20-12-2023 17:14
Static task
static1
Behavioral task
behavioral1
Sample
f3f766676d376e612866849cd7379c3d.exe
Resource
win7-20231215-en
General
-
Target
f3f766676d376e612866849cd7379c3d.exe
-
Size
4.3MB
-
MD5
f3f766676d376e612866849cd7379c3d
-
SHA1
a8d82e59f764ba99fd85fc34db8fe0797ad80794
-
SHA256
8981df04c1b64c842953da435f3c026b3d2587817c08349d04c6021575f4b3c1
-
SHA512
a5f926080ada8246476bade3d3b1b3e2a5ab0387766d4c56bcf7b5c3c503d83c31cf599a2b96777aa21c0eb311d0d8008c2d2c33d9bc9c6c9d7526d777bd85b9
-
SSDEEP
98304:3btAs3T/nMYpnnMhpkz04/zTpnhv34txJfpkJnZ/6QXEv:7rGM4yJhQDJ+516eEv
Malware Config
Extracted
bitrat
1.38
173.44.50.140:4550
-
communication_password
9996535e07258a7bbfd8b132435c5962
-
tor_process
tor
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
RegAsm.exepid process 240 RegAsm.exe 240 RegAsm.exe 240 RegAsm.exe 240 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f3f766676d376e612866849cd7379c3d.exedescription pid process target process PID 1192 set thread context of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1164 1192 WerFault.exe f3f766676d376e612866849cd7379c3d.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
f3f766676d376e612866849cd7379c3d.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1192 f3f766676d376e612866849cd7379c3d.exe Token: SeDebugPrivilege 240 RegAsm.exe Token: SeShutdownPrivilege 240 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 240 RegAsm.exe 240 RegAsm.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
f3f766676d376e612866849cd7379c3d.exedescription pid process target process PID 1192 wrote to memory of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 1192 wrote to memory of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 1192 wrote to memory of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 1192 wrote to memory of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 1192 wrote to memory of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 1192 wrote to memory of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 1192 wrote to memory of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 1192 wrote to memory of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 1192 wrote to memory of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 1192 wrote to memory of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 1192 wrote to memory of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 1192 wrote to memory of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 1192 wrote to memory of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 1192 wrote to memory of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 1192 wrote to memory of 240 1192 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 1192 wrote to memory of 1164 1192 f3f766676d376e612866849cd7379c3d.exe WerFault.exe PID 1192 wrote to memory of 1164 1192 f3f766676d376e612866849cd7379c3d.exe WerFault.exe PID 1192 wrote to memory of 1164 1192 f3f766676d376e612866849cd7379c3d.exe WerFault.exe PID 1192 wrote to memory of 1164 1192 f3f766676d376e612866849cd7379c3d.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3f766676d376e612866849cd7379c3d.exe"C:\Users\Admin\AppData\Local\Temp\f3f766676d376e612866849cd7379c3d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:240 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 8282⤵
- Program crash
PID:1164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/240-22-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-32-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-17-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-5-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-7-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/240-33-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-8-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-6-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-4-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-3-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-12-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-14-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-16-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-34-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-20-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-9-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-24-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-23-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-21-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-19-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-18-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-31-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-30-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-28-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-27-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/240-29-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1192-26-0x0000000000660000-0x00000000006A0000-memory.dmpFilesize
256KB
-
memory/1192-25-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB
-
memory/1192-0-0x0000000000CB0000-0x00000000010F8000-memory.dmpFilesize
4.3MB
-
memory/1192-1-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB
-
memory/1192-2-0x0000000000660000-0x00000000006A0000-memory.dmpFilesize
256KB