Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03-02-2024 06:53
Static task
static1
Behavioral task
behavioral1
Sample
8bae69ff9977ccbaa2abc08a3d19dba1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8bae69ff9977ccbaa2abc08a3d19dba1.exe
Resource
win10v2004-20231215-en
General
-
Target
8bae69ff9977ccbaa2abc08a3d19dba1.exe
-
Size
4.3MB
-
MD5
8bae69ff9977ccbaa2abc08a3d19dba1
-
SHA1
f0cc9269b8f947410a80577fb1efe3df9f4588ba
-
SHA256
169ae4dea8df0b3cc1161b6284432aa853745aec6c1f55a654afcf28a8167d7c
-
SHA512
97e444502c09981159051dd6c6529fd7fafaf2c45f818832620b510e06a5f41740fc72b9812f4930f5e9d56e7537e64fab5bad6a760ad8ed9b9d50d1b5a7f2c7
-
SSDEEP
98304:5gv1yxNN5DwMZCEwEQhTYPL6iezQhNQOzhNgqEmYDpPZ:5gcHPL/wzhTY8zQh/hNgqfYP
Malware Config
Extracted
bitrat
1.38
185.157.160.147:1975
-
communication_password
f49a6667c09a9e329afb64bc0a18a188
-
tor_process
tor
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8bae69ff9977ccbaa2abc08a3d19dba1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fe = "C:\\Users\\Admin\\AppData\\Roaming\\yf\\dg.exe" 8bae69ff9977ccbaa2abc08a3d19dba1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
8bae69ff9977ccbaa2abc08a3d19dba1.exepid process 4108 8bae69ff9977ccbaa2abc08a3d19dba1.exe 4108 8bae69ff9977ccbaa2abc08a3d19dba1.exe 4108 8bae69ff9977ccbaa2abc08a3d19dba1.exe 4108 8bae69ff9977ccbaa2abc08a3d19dba1.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8bae69ff9977ccbaa2abc08a3d19dba1.exedescription pid process target process PID 5672 set thread context of 4108 5672 8bae69ff9977ccbaa2abc08a3d19dba1.exe 8bae69ff9977ccbaa2abc08a3d19dba1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8bae69ff9977ccbaa2abc08a3d19dba1.exedescription pid process Token: SeShutdownPrivilege 4108 8bae69ff9977ccbaa2abc08a3d19dba1.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
8bae69ff9977ccbaa2abc08a3d19dba1.exe8bae69ff9977ccbaa2abc08a3d19dba1.exepid process 5672 8bae69ff9977ccbaa2abc08a3d19dba1.exe 4108 8bae69ff9977ccbaa2abc08a3d19dba1.exe 4108 8bae69ff9977ccbaa2abc08a3d19dba1.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
8bae69ff9977ccbaa2abc08a3d19dba1.exedescription pid process target process PID 5672 wrote to memory of 4108 5672 8bae69ff9977ccbaa2abc08a3d19dba1.exe 8bae69ff9977ccbaa2abc08a3d19dba1.exe PID 5672 wrote to memory of 4108 5672 8bae69ff9977ccbaa2abc08a3d19dba1.exe 8bae69ff9977ccbaa2abc08a3d19dba1.exe PID 5672 wrote to memory of 4108 5672 8bae69ff9977ccbaa2abc08a3d19dba1.exe 8bae69ff9977ccbaa2abc08a3d19dba1.exe PID 5672 wrote to memory of 4108 5672 8bae69ff9977ccbaa2abc08a3d19dba1.exe 8bae69ff9977ccbaa2abc08a3d19dba1.exe PID 5672 wrote to memory of 4108 5672 8bae69ff9977ccbaa2abc08a3d19dba1.exe 8bae69ff9977ccbaa2abc08a3d19dba1.exe PID 5672 wrote to memory of 4108 5672 8bae69ff9977ccbaa2abc08a3d19dba1.exe 8bae69ff9977ccbaa2abc08a3d19dba1.exe PID 5672 wrote to memory of 4108 5672 8bae69ff9977ccbaa2abc08a3d19dba1.exe 8bae69ff9977ccbaa2abc08a3d19dba1.exe PID 5672 wrote to memory of 4108 5672 8bae69ff9977ccbaa2abc08a3d19dba1.exe 8bae69ff9977ccbaa2abc08a3d19dba1.exe PID 5672 wrote to memory of 4108 5672 8bae69ff9977ccbaa2abc08a3d19dba1.exe 8bae69ff9977ccbaa2abc08a3d19dba1.exe PID 5672 wrote to memory of 4108 5672 8bae69ff9977ccbaa2abc08a3d19dba1.exe 8bae69ff9977ccbaa2abc08a3d19dba1.exe PID 5672 wrote to memory of 4108 5672 8bae69ff9977ccbaa2abc08a3d19dba1.exe 8bae69ff9977ccbaa2abc08a3d19dba1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bae69ff9977ccbaa2abc08a3d19dba1.exe"C:\Users\Admin\AppData\Local\Temp\8bae69ff9977ccbaa2abc08a3d19dba1.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8bae69ff9977ccbaa2abc08a3d19dba1.exe"C:\Users\Admin\AppData\Local\Temp\8bae69ff9977ccbaa2abc08a3d19dba1.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4108-4-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-5-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-6-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-7-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-8-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-9-0x0000000075090000-0x00000000750C9000-memory.dmpFilesize
228KB
-
memory/4108-10-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-13-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-15-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-14-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-12-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-17-0x0000000075430000-0x0000000075469000-memory.dmpFilesize
228KB
-
memory/4108-16-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-11-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-18-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-20-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-21-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-22-0x0000000075430000-0x0000000075469000-memory.dmpFilesize
228KB
-
memory/4108-23-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-27-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-28-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-29-0x0000000075430000-0x0000000075469000-memory.dmpFilesize
228KB
-
memory/4108-30-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-33-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-34-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-35-0x0000000075430000-0x0000000075469000-memory.dmpFilesize
228KB
-
memory/4108-36-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-40-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-41-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4108-42-0x0000000075430000-0x0000000075469000-memory.dmpFilesize
228KB
-
memory/4108-43-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB