Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 10:49
Static task
static1
Behavioral task
behavioral1
Sample
Revised Price Inquiry_No248102167.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Revised Price Inquiry_No248102167.exe
Resource
win10v2004-20240611-en
General
-
Target
Revised Price Inquiry_No248102167.exe
-
Size
1.8MB
-
MD5
9a66d51e535e0820c7f2952c65682cff
-
SHA1
5747e789714515f94fa61efd50fd04776299ba2a
-
SHA256
897a44a1a5332bc964180ce5e0ee498e40929b9bb6d624f364a5be844599d757
-
SHA512
51050d337dc495244cb74096da6b1c58e3046ba063a6f9fd62669c5faefd5358dc66482b316e42b7a458dd261603e838afded23b3ab1aab84c743c046b45b3dd
-
SSDEEP
49152:0RCQO4+f1fDuSqZ4X9Cwir1EP6U1P23kZb5+eu/3:0KBfqf4X9CchO3kZ12P
Malware Config
Signatures
-
BitRAT payload 22 IoCs
Processes:
resource yara_rule behavioral2/memory/2128-10-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-12-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-15-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-17-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-18-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-19-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-20-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-21-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-22-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-23-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-25-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-26-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-33-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-34-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-35-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-59-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-60-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-61-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-63-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-64-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-65-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat behavioral2/memory/2128-66-0x0000000000400000-0x0000000000801000-memory.dmp family_bitrat -
Processes:
resource yara_rule behavioral2/memory/2128-10-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-9-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-12-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-7-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-8-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-15-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-17-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-18-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-19-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-20-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-21-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-22-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-23-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-25-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-26-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-33-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-34-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-35-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-59-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-60-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-61-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-63-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-64-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-65-0x0000000000400000-0x0000000000801000-memory.dmp upx behavioral2/memory/2128-66-0x0000000000400000-0x0000000000801000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vlc = "C:\\Users\\Admin\\AppData\\Local\\VideoLAN\\vlc.exe준" RegSvcs.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vlc = "C:\\Users\\Admin\\AppData\\Local\\VideoLAN\\vlc.exe瘀" RegSvcs.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vlc = "C:\\Users\\Admin\\AppData\\Local\\VideoLAN\\vlc.exe" RegSvcs.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vlc = "C:\\Users\\Admin\\AppData\\Local\\VideoLAN\\vlc.exeԀ" RegSvcs.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 34 myexternalip.com 35 myexternalip.com 57 myexternalip.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
Processes:
RegSvcs.exepid process 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe 2128 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Revised Price Inquiry_No248102167.exedescription pid process target process PID 4968 set thread context of 2128 4968 Revised Price Inquiry_No248102167.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Revised Price Inquiry_No248102167.exepid process 4968 Revised Price Inquiry_No248102167.exe 4968 Revised Price Inquiry_No248102167.exe 4968 Revised Price Inquiry_No248102167.exe 4968 Revised Price Inquiry_No248102167.exe 4968 Revised Price Inquiry_No248102167.exe 4968 Revised Price Inquiry_No248102167.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Revised Price Inquiry_No248102167.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 4968 Revised Price Inquiry_No248102167.exe Token: SeShutdownPrivilege 2128 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegSvcs.exepid process 2128 RegSvcs.exe 2128 RegSvcs.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Revised Price Inquiry_No248102167.exedescription pid process target process PID 4968 wrote to memory of 3004 4968 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 4968 wrote to memory of 3004 4968 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 4968 wrote to memory of 3004 4968 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 4968 wrote to memory of 1276 4968 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 4968 wrote to memory of 1276 4968 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 4968 wrote to memory of 1276 4968 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 4968 wrote to memory of 2128 4968 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 4968 wrote to memory of 2128 4968 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 4968 wrote to memory of 2128 4968 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 4968 wrote to memory of 2128 4968 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 4968 wrote to memory of 2128 4968 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 4968 wrote to memory of 2128 4968 Revised Price Inquiry_No248102167.exe RegSvcs.exe PID 4968 wrote to memory of 2128 4968 Revised Price Inquiry_No248102167.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Revised Price Inquiry_No248102167.exe"C:\Users\Admin\AppData\Local\Temp\Revised Price Inquiry_No248102167.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2128-34-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-35-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-66-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-19-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-20-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-64-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-63-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-10-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-9-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-62-0x0000000073690000-0x00000000736C9000-memory.dmpFilesize
228KB
-
memory/2128-61-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-12-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-7-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-8-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-15-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-16-0x0000000074DB0000-0x0000000074DE9000-memory.dmpFilesize
228KB
-
memory/2128-17-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-18-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-60-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-65-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-22-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-21-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-23-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-24-0x0000000074A70000-0x0000000074AA9000-memory.dmpFilesize
228KB
-
memory/2128-25-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-26-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-33-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/2128-59-0x0000000000400000-0x0000000000801000-memory.dmpFilesize
4.0MB
-
memory/4968-1-0x0000000000890000-0x0000000000A5C000-memory.dmpFilesize
1.8MB
-
memory/4968-0-0x0000000074EAE000-0x0000000074EAF000-memory.dmpFilesize
4KB
-
memory/4968-3-0x0000000074EAE000-0x0000000074EAF000-memory.dmpFilesize
4KB
-
memory/4968-13-0x0000000072E85000-0x0000000072E86000-memory.dmpFilesize
4KB
-
memory/4968-14-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4968-6-0x0000000005490000-0x00000000054A2000-memory.dmpFilesize
72KB
-
memory/4968-5-0x00000000055F0000-0x00000000057BA000-memory.dmpFilesize
1.8MB
-
memory/4968-4-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4968-2-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB