Analysis
- max time kernel
150s - max time network
110s - platform
windows10_x64 - resource
win10v20210408 - submitted
11/05/2021, 17:55
General
- Target SecuriteInfo.com.Trojan.GenericKD.46273706.27055.25059.exe
- Size 6.2MB
- Sample210511-7e9ql9rfqa
- SHA256 01b7b62a055cbc890b41ff86f08e5e17c199bea02c876c5d2c2d902cdd2da60f
Malware Config
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- BitRAT Payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Drops startup file 2 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46273706.27055.25059.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46273706.27055.25059.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Apple Software" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iCloud.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Apple Software" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iCloud.exe"3⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iCloud.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iCloud.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/640-122-0x0000000006DC0000-0x0000000006DE1000-memory.dmp
memory/640-119-0x0000000005C30000-0x0000000005C31000-memory.dmp
memory/640-120-0x0000000005DE0000-0x0000000005DE1000-memory.dmp
memory/640-118-0x00000000052D0000-0x00000000052D1000-memory.dmp
memory/640-123-0x0000000006E70000-0x0000000006E71000-memory.dmp
memory/640-124-0x0000000006E30000-0x0000000006E31000-memory.dmp
memory/640-125-0x0000000005DE1000-0x0000000005DE2000-memory.dmp
memory/640-114-0x0000000000380000-0x0000000000381000-memory.dmp
memory/640-117-0x0000000005230000-0x0000000005231000-memory.dmp
memory/640-116-0x0000000005730000-0x0000000005731000-memory.dmp
memory/3756-149-0x0000000000550000-0x000000000091E000-memory.dmp
memory/3756-152-0x0000000000550000-0x000000000091E000-memory.dmp
memory/4060-138-0x0000000006330000-0x0000000006331000-memory.dmp
memory/4060-142-0x0000000006331000-0x0000000006332000-memory.dmp
memory/4060-143-0x0000000003130000-0x000000000313B000-memory.dmp
memory/4060-144-0x00000000071F0000-0x00000000071F1000-memory.dmp