Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2023 17:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f3f766676d376e612866849cd7379c3d.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
General
-
Target
f3f766676d376e612866849cd7379c3d.exe
-
Size
4.3MB
-
MD5
f3f766676d376e612866849cd7379c3d
-
SHA1
a8d82e59f764ba99fd85fc34db8fe0797ad80794
-
SHA256
8981df04c1b64c842953da435f3c026b3d2587817c08349d04c6021575f4b3c1
-
SHA512
a5f926080ada8246476bade3d3b1b3e2a5ab0387766d4c56bcf7b5c3c503d83c31cf599a2b96777aa21c0eb311d0d8008c2d2c33d9bc9c6c9d7526d777bd85b9
-
SSDEEP
98304:3btAs3T/nMYpnnMhpkz04/zTpnhv34txJfpkJnZ/6QXEv:7rGM4yJhQDJ+516eEv
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
173.44.50.140:4550
Attributes
-
communication_password
9996535e07258a7bbfd8b132435c5962
-
tor_process
tor
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
f3f766676d376e612866849cd7379c3d.exedescription pid process target process PID 4456 set thread context of 3688 4456 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4284 4456 WerFault.exe f3f766676d376e612866849cd7379c3d.exe 3188 3688 WerFault.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f3f766676d376e612866849cd7379c3d.exedescription pid process Token: SeDebugPrivilege 4456 f3f766676d376e612866849cd7379c3d.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
f3f766676d376e612866849cd7379c3d.exedescription pid process target process PID 4456 wrote to memory of 3688 4456 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 4456 wrote to memory of 3688 4456 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 4456 wrote to memory of 3688 4456 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 4456 wrote to memory of 3688 4456 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 4456 wrote to memory of 3688 4456 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 4456 wrote to memory of 3688 4456 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 4456 wrote to memory of 3688 4456 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 4456 wrote to memory of 3688 4456 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 4456 wrote to memory of 3688 4456 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 4456 wrote to memory of 3688 4456 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe PID 4456 wrote to memory of 3688 4456 f3f766676d376e612866849cd7379c3d.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3f766676d376e612866849cd7379c3d.exe"C:\Users\Admin\AppData\Local\Temp\f3f766676d376e612866849cd7379c3d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 5403⤵
- Program crash
PID:3188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 11602⤵
- Program crash
PID:4284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4456 -ip 44561⤵PID:540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3688 -ip 36881⤵PID:880
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3688-7-0x0000000000B00000-0x0000000000ECE000-memory.dmpFilesize
3.8MB
-
memory/3688-11-0x0000000000B00000-0x0000000000ECE000-memory.dmpFilesize
3.8MB
-
memory/3688-16-0x0000000000B00000-0x0000000000ECE000-memory.dmpFilesize
3.8MB
-
memory/3688-15-0x0000000000B00000-0x0000000000ECE000-memory.dmpFilesize
3.8MB
-
memory/4456-1-0x0000000000DD0000-0x0000000001218000-memory.dmpFilesize
4.3MB
-
memory/4456-0-0x0000000074E60000-0x0000000075610000-memory.dmpFilesize
7.7MB
-
memory/4456-2-0x00000000059F0000-0x0000000005F94000-memory.dmpFilesize
5.6MB
-
memory/4456-3-0x00000000054E0000-0x0000000005572000-memory.dmpFilesize
584KB
-
memory/4456-4-0x0000000005380000-0x0000000005390000-memory.dmpFilesize
64KB
-
memory/4456-5-0x0000000005900000-0x000000000590A000-memory.dmpFilesize
40KB
-
memory/4456-17-0x0000000074E60000-0x0000000075610000-memory.dmpFilesize
7.7MB