Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
17-03-2024 13:22
Static task
static1
Behavioral task
behavioral1
Sample
d0f8c7eda9a5e772e3be9c3b67f43e35.exe
Resource
win7-20240221-en
General
-
Target
d0f8c7eda9a5e772e3be9c3b67f43e35.exe
-
Size
4.0MB
-
MD5
d0f8c7eda9a5e772e3be9c3b67f43e35
-
SHA1
d73903af0fa940d67c123eb6e6722325e656c9c0
-
SHA256
29f877de694aa77ca19d69ce15720a139b75f201761df81c70b64354290c87c2
-
SHA512
d80dcfd2bb53674dca019cba0bed0894030da893d492baa38392ead742adc86e3722a0b0c490352ea263d01d8a8e02a0ed71cda183d3abecdeaca54feb380597
-
SSDEEP
98304:uVXHrDqvnhfHh5Evm6KdlS522XiFC7o3vUzGJ:WXUhfnmmfz2J7Y
Malware Config
Extracted
bitrat
1.38
8.208.27.150:4550
-
communication_password
9996535e07258a7bbfd8b132435c5962
-
tor_process
tor
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rarr.exed0f8c7eda9a5e772e3be9c3b67f43e35.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation rarr.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation d0f8c7eda9a5e772e3be9c3b67f43e35.exe -
Executes dropped EXE 1 IoCs
Processes:
rarr.exepid process 4124 rarr.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
d0f8c7eda9a5e772e3be9c3b67f43e35.exerarr.exedescription pid process target process PID 2444 set thread context of 1424 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 4124 set thread context of 3628 4124 rarr.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1868 1424 WerFault.exe vbc.exe 1172 3628 WerFault.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d0f8c7eda9a5e772e3be9c3b67f43e35.exerarr.exedescription pid process Token: SeDebugPrivilege 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe Token: SeDebugPrivilege 4124 rarr.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
d0f8c7eda9a5e772e3be9c3b67f43e35.execmd.exerarr.exedescription pid process target process PID 2444 wrote to memory of 5028 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 2444 wrote to memory of 5028 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 2444 wrote to memory of 5028 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 2444 wrote to memory of 1424 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 2444 wrote to memory of 1424 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 2444 wrote to memory of 1424 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 2444 wrote to memory of 1424 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 2444 wrote to memory of 1424 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 2444 wrote to memory of 1424 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 2444 wrote to memory of 1424 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 2444 wrote to memory of 1424 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 2444 wrote to memory of 1424 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 2444 wrote to memory of 1424 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 2444 wrote to memory of 1424 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe vbc.exe PID 2444 wrote to memory of 4412 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 2444 wrote to memory of 4412 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 2444 wrote to memory of 4412 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 2444 wrote to memory of 5036 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 2444 wrote to memory of 5036 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 2444 wrote to memory of 5036 2444 d0f8c7eda9a5e772e3be9c3b67f43e35.exe cmd.exe PID 4412 wrote to memory of 4636 4412 cmd.exe schtasks.exe PID 4412 wrote to memory of 4636 4412 cmd.exe schtasks.exe PID 4412 wrote to memory of 4636 4412 cmd.exe schtasks.exe PID 4124 wrote to memory of 4404 4124 rarr.exe cmd.exe PID 4124 wrote to memory of 4404 4124 rarr.exe cmd.exe PID 4124 wrote to memory of 4404 4124 rarr.exe cmd.exe PID 4124 wrote to memory of 3628 4124 rarr.exe vbc.exe PID 4124 wrote to memory of 3628 4124 rarr.exe vbc.exe PID 4124 wrote to memory of 3628 4124 rarr.exe vbc.exe PID 4124 wrote to memory of 3628 4124 rarr.exe vbc.exe PID 4124 wrote to memory of 3628 4124 rarr.exe vbc.exe PID 4124 wrote to memory of 3628 4124 rarr.exe vbc.exe PID 4124 wrote to memory of 3628 4124 rarr.exe vbc.exe PID 4124 wrote to memory of 3628 4124 rarr.exe vbc.exe PID 4124 wrote to memory of 3628 4124 rarr.exe vbc.exe PID 4124 wrote to memory of 3628 4124 rarr.exe vbc.exe PID 4124 wrote to memory of 3628 4124 rarr.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0f8c7eda9a5e772e3be9c3b67f43e35.exe"C:\Users\Admin\AppData\Local\Temp\d0f8c7eda9a5e772e3be9c3b67f43e35.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 1883⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "NanoShield" /tr "'C:\Users\Admin\AppData\Roaming\rarr\rarr.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "NanoShield" /tr "'C:\Users\Admin\AppData\Roaming\rarr\rarr.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\d0f8c7eda9a5e772e3be9c3b67f43e35.exe" "C:\Users\Admin\AppData\Roaming\rarr\rarr.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1424 -ip 14241⤵
-
C:\Users\Admin\AppData\Roaming\rarr\rarr.exeC:\Users\Admin\AppData\Roaming\rarr\rarr.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 1883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3628 -ip 36281⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\rarr\rarr.exeFilesize
1.2MB
MD5806c3b0a93eeff79e24c1ab337561cbd
SHA1089596126178324ab047f64dd346be1abe1367ab
SHA2567397400b6fb629c0aa3227495f26614f4630954699fa0227a12141af143e1661
SHA512cda936323f85790a20b84cc9c8bc186012eee7f81211990747c50c9af94eff0b001e455f188a99b724adc3d55704be148eeef3c763305a1c16ca96970b06ca1b
-
C:\Users\Admin\AppData\Roaming\rarr\rarr.exeFilesize
1.2MB
MD50c59151a9711e254028e6f7b6dd50a39
SHA1ea335ad4cca3e2c78a2f9b7e0c63474e10c11d66
SHA256416386bd57a75337e8b32a65f479b21188c4dd1955a60eea21d712bf0b86b0a8
SHA512bef8090274d304da223eefef0556bebae20320f6f42441674e0c6f0972ad798cccdb13d8201027826e2e034ab1dd32b9d9dc5f8bf5a45ff824046fad33e95dfd
-
memory/1424-15-0x0000000001100000-0x00000000014CE000-memory.dmpFilesize
3.8MB
-
memory/1424-7-0x0000000001100000-0x00000000014CE000-memory.dmpFilesize
3.8MB
-
memory/1424-11-0x0000000001100000-0x00000000014CE000-memory.dmpFilesize
3.8MB
-
memory/2444-16-0x0000000074830000-0x0000000074FE0000-memory.dmpFilesize
7.7MB
-
memory/2444-5-0x0000000004F00000-0x0000000004F0A000-memory.dmpFilesize
40KB
-
memory/2444-4-0x00000000050F0000-0x0000000005100000-memory.dmpFilesize
64KB
-
memory/2444-0-0x00000000004A0000-0x00000000008A8000-memory.dmpFilesize
4.0MB
-
memory/2444-3-0x0000000004F10000-0x0000000004FA2000-memory.dmpFilesize
584KB
-
memory/2444-17-0x00000000050F0000-0x0000000005100000-memory.dmpFilesize
64KB
-
memory/2444-2-0x0000000005420000-0x00000000059C4000-memory.dmpFilesize
5.6MB
-
memory/2444-1-0x0000000074830000-0x0000000074FE0000-memory.dmpFilesize
7.7MB
-
memory/3628-30-0x0000000000D70000-0x000000000113E000-memory.dmpFilesize
3.8MB
-
memory/3628-34-0x0000000000D70000-0x000000000113E000-memory.dmpFilesize
3.8MB
-
memory/4124-23-0x0000000000590000-0x0000000000998000-memory.dmpFilesize
4.0MB
-
memory/4124-22-0x0000000074830000-0x0000000074FE0000-memory.dmpFilesize
7.7MB
-
memory/4124-24-0x00000000050A0000-0x00000000050B0000-memory.dmpFilesize
64KB