Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-03-2024 13:22
Static task
static1
Behavioral task
behavioral1
Sample
d0f8c7eda9a5e772e3be9c3b67f43e35.exe
Resource
win7-20240221-en
General
-
Target
d0f8c7eda9a5e772e3be9c3b67f43e35.exe
-
Size
4.0MB
-
MD5
d0f8c7eda9a5e772e3be9c3b67f43e35
-
SHA1
d73903af0fa940d67c123eb6e6722325e656c9c0
-
SHA256
29f877de694aa77ca19d69ce15720a139b75f201761df81c70b64354290c87c2
-
SHA512
d80dcfd2bb53674dca019cba0bed0894030da893d492baa38392ead742adc86e3722a0b0c490352ea263d01d8a8e02a0ed71cda183d3abecdeaca54feb380597
-
SSDEEP
98304:uVXHrDqvnhfHh5Evm6KdlS522XiFC7o3vUzGJ:WXUhfnmmfz2J7Y
Malware Config
Extracted
bitrat
1.38
8.208.27.150:4550
-
communication_password
9996535e07258a7bbfd8b132435c5962
-
tor_process
tor
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rarr.exepid process 2212 rarr.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
vbc.exevbc.exepid process 2920 vbc.exe 2920 vbc.exe 2920 vbc.exe 2920 vbc.exe 1952 vbc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
d0f8c7eda9a5e772e3be9c3b67f43e35.exerarr.exedescription pid process target process PID 3024 set thread context of 2920 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 2212 set thread context of 1952 2212 rarr.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
d0f8c7eda9a5e772e3be9c3b67f43e35.exevbc.exerarr.exevbc.exedescription pid process Token: SeDebugPrivilege 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe Token: SeDebugPrivilege 2920 vbc.exe Token: SeShutdownPrivilege 2920 vbc.exe Token: SeDebugPrivilege 2212 rarr.exe Token: SeDebugPrivilege 1952 vbc.exe Token: SeShutdownPrivilege 1952 vbc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
vbc.exepid process 2920 vbc.exe 2920 vbc.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
d0f8c7eda9a5e772e3be9c3b67f43e35.execmd.exetaskeng.exerarr.exedescription pid process target process PID 3024 wrote to memory of 2696 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 3024 wrote to memory of 2696 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 3024 wrote to memory of 2696 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 3024 wrote to memory of 2696 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 3024 wrote to memory of 2920 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 3024 wrote to memory of 2920 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 3024 wrote to memory of 2920 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 3024 wrote to memory of 2920 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 3024 wrote to memory of 2920 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 3024 wrote to memory of 2920 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 3024 wrote to memory of 2920 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 3024 wrote to memory of 2920 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 3024 wrote to memory of 2920 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 3024 wrote to memory of 2920 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 3024 wrote to memory of 2920 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 3024 wrote to memory of 2920 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 3024 wrote to memory of 608 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 3024 wrote to memory of 608 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 3024 wrote to memory of 608 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 3024 wrote to memory of 608 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 3024 wrote to memory of 2844 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 3024 wrote to memory of 2844 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 3024 wrote to memory of 2844 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 3024 wrote to memory of 2844 3024 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 608 wrote to memory of 2860 608 cmd.exe schtasks.exe PID 608 wrote to memory of 2860 608 cmd.exe schtasks.exe PID 608 wrote to memory of 2860 608 cmd.exe schtasks.exe PID 608 wrote to memory of 2860 608 cmd.exe schtasks.exe PID 1636 wrote to memory of 2212 1636 taskeng.exe rarr.exe PID 1636 wrote to memory of 2212 1636 taskeng.exe rarr.exe PID 1636 wrote to memory of 2212 1636 taskeng.exe rarr.exe PID 1636 wrote to memory of 2212 1636 taskeng.exe rarr.exe PID 2212 wrote to memory of 2344 2212 rarr.exe cmd.exe PID 2212 wrote to memory of 2344 2212 rarr.exe cmd.exe PID 2212 wrote to memory of 2344 2212 rarr.exe cmd.exe PID 2212 wrote to memory of 2344 2212 rarr.exe cmd.exe PID 2212 wrote to memory of 1952 2212 rarr.exe vbc.exe PID 2212 wrote to memory of 1952 2212 rarr.exe vbc.exe PID 2212 wrote to memory of 1952 2212 rarr.exe vbc.exe PID 2212 wrote to memory of 1952 2212 rarr.exe vbc.exe PID 2212 wrote to memory of 1952 2212 rarr.exe vbc.exe PID 2212 wrote to memory of 1952 2212 rarr.exe vbc.exe PID 2212 wrote to memory of 1952 2212 rarr.exe vbc.exe PID 2212 wrote to memory of 1952 2212 rarr.exe vbc.exe PID 2212 wrote to memory of 1952 2212 rarr.exe vbc.exe PID 2212 wrote to memory of 1952 2212 rarr.exe vbc.exe PID 2212 wrote to memory of 1952 2212 rarr.exe vbc.exe PID 2212 wrote to memory of 1952 2212 rarr.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0f8c7eda9a5e772e3be9c3b67f43e35.exe"C:\Users\Admin\AppData\Local\Temp\d0f8c7eda9a5e772e3be9c3b67f43e35.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "NanoShield" /tr "'C:\Users\Admin\AppData\Roaming\rarr\rarr.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "NanoShield" /tr "'C:\Users\Admin\AppData\Roaming\rarr\rarr.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\d0f8c7eda9a5e772e3be9c3b67f43e35.exe" "C:\Users\Admin\AppData\Roaming\rarr\rarr.exe"2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {E3BA1913-8A58-427D-AD6D-43C25351F769} S-1-5-21-2461186416-2307104501-1787948496-1000:MGILJUBR\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\rarr\rarr.exeC:\Users\Admin\AppData\Roaming\rarr\rarr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\rarr\rarr.exeFilesize
4.0MB
MD5d0f8c7eda9a5e772e3be9c3b67f43e35
SHA1d73903af0fa940d67c123eb6e6722325e656c9c0
SHA25629f877de694aa77ca19d69ce15720a139b75f201761df81c70b64354290c87c2
SHA512d80dcfd2bb53674dca019cba0bed0894030da893d492baa38392ead742adc86e3722a0b0c490352ea263d01d8a8e02a0ed71cda183d3abecdeaca54feb380597
-
memory/1952-55-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1952-54-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2212-57-0x0000000005210000-0x0000000005250000-memory.dmpFilesize
256KB
-
memory/2212-56-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB
-
memory/2212-38-0x0000000005210000-0x0000000005250000-memory.dmpFilesize
256KB
-
memory/2212-37-0x0000000001020000-0x0000000001428000-memory.dmpFilesize
4.0MB
-
memory/2212-36-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB
-
memory/2920-22-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-27-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-12-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2920-13-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-15-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-16-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-19-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-20-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-21-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-17-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-59-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-23-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-58-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-3-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-26-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-11-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-28-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-29-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-33-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-32-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-10-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-9-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-7-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-5-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2920-4-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/3024-25-0x00000000051A0000-0x00000000051E0000-memory.dmpFilesize
256KB
-
memory/3024-2-0x00000000051A0000-0x00000000051E0000-memory.dmpFilesize
256KB
-
memory/3024-0-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB
-
memory/3024-24-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB
-
memory/3024-1-0x0000000000EF0000-0x00000000012F8000-memory.dmpFilesize
4.0MB