Analysis
-
max time kernel
147s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-03-2024 06:47
Static task
static1
Behavioral task
behavioral1
Sample
d825fa02ed9b209b329dfd2eb8bfc29a.exe
Resource
win7-20240221-en
General
-
Target
d825fa02ed9b209b329dfd2eb8bfc29a.exe
-
Size
3.5MB
-
MD5
d825fa02ed9b209b329dfd2eb8bfc29a
-
SHA1
a504da00ac20b1b5c7e8a375e18ebd210fb3d3f5
-
SHA256
2b590ae0dbb1cfe013c780beaad0401d7fc483c9d5f453cf23b79faa7adfd67f
-
SHA512
9008ee92c62d2c81efc89bfca9c606083dd39aedc9057062c194d9a5f0aa566010f5fa8c369fb4e4f69275466acbc571159933efd45f89d52bc58182ece94fbc
-
SSDEEP
49152:vLVwb6UKSZrEW33E+pNfwJEqNsAjYQcXaD+2GVxo85odrpxeyprdY8Q1ZLKx:vLxQF6TjhGVaTBmh
Malware Config
Extracted
bitrat
1.30
Signatures
-
BitRAT payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2908-19-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-20-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-21-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-24-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-26-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-28-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-29-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-32-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-31-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-30-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-33-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-35-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-34-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-36-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-37-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-38-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-39-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-40-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat behavioral1/memory/2908-41-0x0000000000400000-0x000000000079E000-memory.dmp family_bitrat -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
d825fa02ed9b209b329dfd2eb8bfc29a.exepid process 2908 d825fa02ed9b209b329dfd2eb8bfc29a.exe 2908 d825fa02ed9b209b329dfd2eb8bfc29a.exe 2908 d825fa02ed9b209b329dfd2eb8bfc29a.exe 2908 d825fa02ed9b209b329dfd2eb8bfc29a.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d825fa02ed9b209b329dfd2eb8bfc29a.exedescription pid process target process PID 2112 set thread context of 2908 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe d825fa02ed9b209b329dfd2eb8bfc29a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d825fa02ed9b209b329dfd2eb8bfc29a.exedescription pid process Token: SeDebugPrivilege 2908 d825fa02ed9b209b329dfd2eb8bfc29a.exe Token: SeShutdownPrivilege 2908 d825fa02ed9b209b329dfd2eb8bfc29a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
d825fa02ed9b209b329dfd2eb8bfc29a.exepid process 2908 d825fa02ed9b209b329dfd2eb8bfc29a.exe 2908 d825fa02ed9b209b329dfd2eb8bfc29a.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
d825fa02ed9b209b329dfd2eb8bfc29a.exedescription pid process target process PID 2112 wrote to memory of 2524 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe schtasks.exe PID 2112 wrote to memory of 2524 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe schtasks.exe PID 2112 wrote to memory of 2524 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe schtasks.exe PID 2112 wrote to memory of 2524 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe schtasks.exe PID 2112 wrote to memory of 2908 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe d825fa02ed9b209b329dfd2eb8bfc29a.exe PID 2112 wrote to memory of 2908 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe d825fa02ed9b209b329dfd2eb8bfc29a.exe PID 2112 wrote to memory of 2908 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe d825fa02ed9b209b329dfd2eb8bfc29a.exe PID 2112 wrote to memory of 2908 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe d825fa02ed9b209b329dfd2eb8bfc29a.exe PID 2112 wrote to memory of 2908 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe d825fa02ed9b209b329dfd2eb8bfc29a.exe PID 2112 wrote to memory of 2908 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe d825fa02ed9b209b329dfd2eb8bfc29a.exe PID 2112 wrote to memory of 2908 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe d825fa02ed9b209b329dfd2eb8bfc29a.exe PID 2112 wrote to memory of 2908 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe d825fa02ed9b209b329dfd2eb8bfc29a.exe PID 2112 wrote to memory of 2908 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe d825fa02ed9b209b329dfd2eb8bfc29a.exe PID 2112 wrote to memory of 2908 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe d825fa02ed9b209b329dfd2eb8bfc29a.exe PID 2112 wrote to memory of 2908 2112 d825fa02ed9b209b329dfd2eb8bfc29a.exe d825fa02ed9b209b329dfd2eb8bfc29a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d825fa02ed9b209b329dfd2eb8bfc29a.exe"C:\Users\Admin\AppData\Local\Temp\d825fa02ed9b209b329dfd2eb8bfc29a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pNmCBdixl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDDB2.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\d825fa02ed9b209b329dfd2eb8bfc29a.exe"C:\Users\Admin\AppData\Local\Temp\d825fa02ed9b209b329dfd2eb8bfc29a.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpDDB2.tmpFilesize
1KB
MD54b1edae2f1c1025c946b0fd3962534d1
SHA189599f02aa840edb1a54a233722e343286d2d9c4
SHA2563992daca03cfda12317bd97a6fe33c6b0a668fe94a2d08747352a02c054fd712
SHA512b1f85be895ef6ebae9929700d795a2fd8eaa9752082e2687c1d056b70af470b7b07fff0d03f30c95331c1e0bfe986c1cc377da0e98b1d3b5bf7e599d522b166e
-
memory/2112-0-0x0000000000F10000-0x0000000001292000-memory.dmpFilesize
3.5MB
-
memory/2112-1-0x0000000074840000-0x0000000074F2E000-memory.dmpFilesize
6.9MB
-
memory/2112-2-0x00000000071C0000-0x0000000007514000-memory.dmpFilesize
3.3MB
-
memory/2112-3-0x0000000004700000-0x0000000004740000-memory.dmpFilesize
256KB
-
memory/2112-4-0x000000000CC80000-0x000000000CC88000-memory.dmpFilesize
32KB
-
memory/2112-5-0x0000000074840000-0x0000000074F2E000-memory.dmpFilesize
6.9MB
-
memory/2112-6-0x0000000004700000-0x0000000004740000-memory.dmpFilesize
256KB
-
memory/2112-7-0x000000000F7D0000-0x000000000FB22000-memory.dmpFilesize
3.3MB
-
memory/2112-8-0x000000000FB20000-0x000000000FEE6000-memory.dmpFilesize
3.8MB
-
memory/2112-27-0x0000000074840000-0x0000000074F2E000-memory.dmpFilesize
6.9MB
-
memory/2908-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2908-32-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-19-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-20-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-21-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-16-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-24-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-26-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-14-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-28-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-29-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-18-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-31-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-30-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-33-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-35-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-34-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-36-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-37-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-38-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-39-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-40-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2908-41-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB