Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 10:49
Static task
static1
Behavioral task
behavioral1
Sample
Revised Price Inquiry_No248102167.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Revised Price Inquiry_No248102167.exe
Resource
win10v2004-20240611-en
General
-
Target
Revised Price Inquiry_No248102167.exe
-
Size
1.8MB
-
MD5
9a66d51e535e0820c7f2952c65682cff
-
SHA1
5747e789714515f94fa61efd50fd04776299ba2a
-
SHA256
897a44a1a5332bc964180ce5e0ee498e40929b9bb6d624f364a5be844599d757
-
SHA512
51050d337dc495244cb74096da6b1c58e3046ba063a6f9fd62669c5faefd5358dc66482b316e42b7a458dd261603e838afded23b3ab1aab84c743c046b45b3dd
-
SSDEEP
49152:0RCQO4+f1fDuSqZ4X9Cwir1EP6U1P23kZb5+eu/3:0KBfqf4X9CchO3kZ12P
Malware Config
Signatures
-
BitRAT payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2580-20-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-17-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-18-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-21-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-24-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-23-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-22-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-26-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-25-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-27-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-28-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-29-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-30-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-48-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-49-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-51-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-76-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-77-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-78-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-79-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-82-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral1/memory/2580-83-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat -
Processes:
resource yara_rule behavioral1/memory/2580-8-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-10-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-20-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-17-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-16-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-15-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-14-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-18-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-21-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-24-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-23-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-22-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-26-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-25-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-27-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-28-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-29-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-30-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-48-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-49-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-51-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-76-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-77-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-78-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-79-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-82-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral1/memory/2580-83-0x0000000000400000-0x0000000000801000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\vlc = "C:\\Users\\Admin\\AppData\\Local\\VideoLAN\\vlc.exe" RegSvcs.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 myexternalip.com 8 myexternalip.com 19 myexternalip.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
Processes:
RegSvcs.exepid process 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe 2580 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Revised Price Inquiry_No248102167.exedescription pid process target process PID 2020 set thread context of 2580 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Revised Price Inquiry_No248102167.exepid process 2020 Revised Price Inquiry_No248102167.exe 2020 Revised Price Inquiry_No248102167.exe 2020 Revised Price Inquiry_No248102167.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Revised Price Inquiry_No248102167.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2020 Revised Price Inquiry_No248102167.exe Token: SeShutdownPrivilege 2580 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegSvcs.exepid process 2580 RegSvcs.exe 2580 RegSvcs.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Revised Price Inquiry_No248102167.exedescription pid process target process PID 2020 wrote to memory of 2576 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2576 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2576 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2576 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2576 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2576 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2576 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2580 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2580 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2580 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2580 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2580 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2580 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2580 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2580 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2580 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2580 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 2020 wrote to memory of 2580 2020 Revised Price Inquiry_No248102167.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Revised Price Inquiry_No248102167.exe"C:\Users\Admin\AppData\Local\Temp\Revised Price Inquiry_No248102167.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2020-19-0x0000000074DC0000-0x00000000754AE000-memory.dmpFilesize
6.9MB
-
memory/2020-1-0x0000000000A60000-0x0000000000C2C000-memory.dmpFilesize
1.8MB
-
memory/2020-2-0x0000000074DC0000-0x00000000754AE000-memory.dmpFilesize
6.9MB
-
memory/2020-3-0x0000000074DCE000-0x0000000074DCF000-memory.dmpFilesize
4KB
-
memory/2020-4-0x0000000074DC0000-0x00000000754AE000-memory.dmpFilesize
6.9MB
-
memory/2020-5-0x0000000004F40000-0x000000000510A000-memory.dmpFilesize
1.8MB
-
memory/2020-6-0x0000000000700000-0x0000000000712000-memory.dmpFilesize
72KB
-
memory/2020-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmpFilesize
4KB
-
memory/2580-23-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-28-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-10-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-20-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-7-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-17-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-16-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-15-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-14-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-18-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-21-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-24-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-8-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-22-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-26-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-25-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-27-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2580-29-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-30-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-32-0x0000000000340000-0x000000000034A000-memory.dmpFilesize
40KB
-
memory/2580-31-0x0000000000340000-0x000000000034A000-memory.dmpFilesize
40KB
-
memory/2580-48-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-49-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-51-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-59-0x0000000000340000-0x000000000034A000-memory.dmpFilesize
40KB
-
memory/2580-58-0x0000000000340000-0x000000000034A000-memory.dmpFilesize
40KB
-
memory/2580-76-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-77-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-78-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-79-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-81-0x0000000000AC0000-0x0000000000ACA000-memory.dmpFilesize
40KB
-
memory/2580-80-0x0000000000AC0000-0x0000000000ACA000-memory.dmpFilesize
40KB
-
memory/2580-82-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2580-83-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB