Resubmissions
01/06/2021, 13:06
210601-sb75wldly61001/06/2021, 13:02
210601-z1jsgx6mjj1001/06/2021, 12:30
210601-hpfkegggvn301/06/2021, 10:04
210601-641q74s1vj10Analysis
- max time kernel
598s - max time network
634s - platform
windows7_x64 - resource
win7v20210408 - submitted
01/06/2021, 13:06
General
- Target Booking Confirmation 645476578686879 -copy- PDF.exe
- Size 2.5MB
- Sample210601-sb75wldly6
- SHA256 85ba34242c6c231c5cad5de3996e443148da47505a9fd3a6f41af32fcfc22652
Malware Config
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- BitRAT Payload 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Booking Confirmation 645476578686879 -copy- PDF.exe"C:\Users\Admin\AppData\Local\Temp\Booking Confirmation 645476578686879 -copy- PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Dstajkc.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chrome.net\chrome.net.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Booking Confirmation 645476578686879 -copy- PDF.exe"C:\Users\Admin\AppData\Local\Temp\Booking Confirmation 645476578686879 -copy- PDF.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1524-66-0x0000000075041000-0x0000000075043000-memory.dmp
memory/1580-74-0x00000000049C0000-0x00000000049C1000-memory.dmp
memory/1580-87-0x00000000057A0000-0x00000000057A1000-memory.dmp
memory/1580-111-0x00000000062D0000-0x00000000062D1000-memory.dmp
memory/1580-110-0x00000000062C0000-0x00000000062C1000-memory.dmp
memory/1580-96-0x00000000055E0000-0x00000000055E1000-memory.dmp
memory/1580-95-0x000000007EF30000-0x000000007EF31000-memory.dmp
memory/1580-94-0x0000000006240000-0x0000000006241000-memory.dmp
memory/1580-73-0x0000000000D70000-0x0000000000D71000-memory.dmp
memory/1580-86-0x00000000056F0000-0x00000000056F1000-memory.dmp
memory/1580-75-0x0000000004980000-0x0000000004981000-memory.dmp
memory/1580-76-0x0000000004982000-0x0000000004983000-memory.dmp
memory/1580-77-0x00000000012D0000-0x00000000012D1000-memory.dmp
memory/1580-78-0x0000000004950000-0x0000000004951000-memory.dmp
memory/1580-81-0x0000000005660000-0x0000000005661000-memory.dmp
memory/1636-59-0x0000000000890000-0x0000000000891000-memory.dmp
memory/1636-63-0x0000000000210000-0x0000000000227000-memory.dmp
memory/1636-61-0x00000000003D0000-0x000000000041E000-memory.dmp
memory/1636-62-0x00000000022B0000-0x00000000022B1000-memory.dmp
memory/1660-70-0x0000000000400000-0x00000000007CE000-memory.dmp
memory/1660-67-0x0000000000400000-0x00000000007CE000-memory.dmp