Analysis
-
max time kernel
142s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28-12-2023 19:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f16151d0d1ea959552d2fe8a724b0dc5.exe
Resource
win7-20231215-en
4 signatures
150 seconds
General
-
Target
f16151d0d1ea959552d2fe8a724b0dc5.exe
-
Size
5.0MB
-
MD5
f16151d0d1ea959552d2fe8a724b0dc5
-
SHA1
d71382495ec36153ce86cb0e94755d283fbe53e6
-
SHA256
6248ca77e095fba357308535038777b0e555c085dfa828a6f16faac4d818a7a3
-
SHA512
3f9b550ed515a5e0f3f99f2235bef39d1a8332496b1e37cdf107c1ab4d54875c8a6142d3a5c277c504328b04821cd8d46608e0c2c977a4c256e1530f20096e57
-
SSDEEP
98304:viS/sRZddY2EGcHg/InwJtNELakTwPAALRuPa6o0h7:vxkZdCvGwbaYTas5o09
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
elevenpaths.cc:420
Attributes
-
communication_password
e48e13207341b6bffb7fb1622282247b
-
tor_process
tor
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
f16151d0d1ea959552d2fe8a724b0dc5.exepid process 2392 f16151d0d1ea959552d2fe8a724b0dc5.exe 2392 f16151d0d1ea959552d2fe8a724b0dc5.exe 2392 f16151d0d1ea959552d2fe8a724b0dc5.exe 2392 f16151d0d1ea959552d2fe8a724b0dc5.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f16151d0d1ea959552d2fe8a724b0dc5.exedescription pid process Token: SeDebugPrivilege 2392 f16151d0d1ea959552d2fe8a724b0dc5.exe Token: SeShutdownPrivilege 2392 f16151d0d1ea959552d2fe8a724b0dc5.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f16151d0d1ea959552d2fe8a724b0dc5.exepid process 2392 f16151d0d1ea959552d2fe8a724b0dc5.exe 2392 f16151d0d1ea959552d2fe8a724b0dc5.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2392-0-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2392-1-0x00000000035C0000-0x0000000003A69000-memory.dmpFilesize
4.7MB
-
memory/2392-2-0x0000000000400000-0x000000000090E000-memory.dmpFilesize
5.1MB
-
memory/2392-4-0x0000000000400000-0x000000000090E000-memory.dmpFilesize
5.1MB
-
memory/2392-5-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2392-6-0x0000000000400000-0x000000000090E000-memory.dmpFilesize
5.1MB
-
memory/2392-7-0x0000000000400000-0x000000000090E000-memory.dmpFilesize
5.1MB
-
memory/2392-9-0x0000000000400000-0x000000000090E000-memory.dmpFilesize
5.1MB
-
memory/2392-10-0x0000000000400000-0x000000000090E000-memory.dmpFilesize
5.1MB
-
memory/2392-11-0x0000000000400000-0x000000000090E000-memory.dmpFilesize
5.1MB
-
memory/2392-13-0x0000000000400000-0x000000000090E000-memory.dmpFilesize
5.1MB
-
memory/2392-14-0x0000000000400000-0x000000000090E000-memory.dmpFilesize
5.1MB
-
memory/2392-16-0x0000000000400000-0x000000000090E000-memory.dmpFilesize
5.1MB