Analysis

  • max time kernel
    151s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    30-07-2021 15:25

General

  • Target

    685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe

  • Size

    2.2MB

  • MD5

    9882d9bb0a03a191d8ba9b4bc9c254c5

  • SHA1

    23bbe2b78cfb4d2c1232fb48bda0dc1ea30222d6

  • SHA256

    685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03

  • SHA512

    c3d683b765eb78dd21105096da079720a4b3abf717cb170b88059e900bd3749caf8002f125e7a0d6e4be2f4f703a5267d951af565eb4ba2a635d0233a8fdb6cc

Score
10/10

Malware Config

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • BitRAT Payload 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe
    "C:\Users\Admin\AppData\Local\Temp\685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Ramerkpoygerkjyr.vbs"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1524
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mocenter\Moupdate.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:788
    • C:\Users\Admin\AppData\Local\Temp\685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe
      C:\Users\Admin\AppData\Local\Temp\685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2140

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_Ramerkpoygerkjyr.vbs

    MD5

    4c3b08d7af0401a66aa7934a5f533276

    SHA1

    b5638475f3422d083a825a88a753db5e05666923

    SHA256

    59f8fbd0ff79380d28c47847b14b846dd52ff36b00a08690c4cf5292b8dc5dc4

    SHA512

    5497a31e5d47d2baa3bc43b6677fd8f35b55ed79e25bb831f5ee7c48c32e9aed9323a9b8d96dfc7ebe6ca3d3964f2d85ebaa2203a25b4b142ef2334542d87a0f

  • memory/788-145-0x0000000008260000-0x0000000008261000-memory.dmp

    Filesize

    4KB

  • memory/788-144-0x0000000007980000-0x0000000007981000-memory.dmp

    Filesize

    4KB

  • memory/788-137-0x0000000006CB0000-0x0000000006CB1000-memory.dmp

    Filesize

    4KB

  • memory/788-362-0x00000000094E0000-0x00000000094E1000-memory.dmp

    Filesize

    4KB

  • memory/788-136-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

    Filesize

    4KB

  • memory/788-171-0x000000007F110000-0x000000007F111000-memory.dmp

    Filesize

    4KB

  • memory/788-138-0x00000000072F0000-0x00000000072F1000-memory.dmp

    Filesize

    4KB

  • memory/788-167-0x0000000009580000-0x0000000009581000-memory.dmp

    Filesize

    4KB

  • memory/788-166-0x0000000009400000-0x0000000009401000-memory.dmp

    Filesize

    4KB

  • memory/788-161-0x0000000006E20000-0x0000000006E21000-memory.dmp

    Filesize

    4KB

  • memory/788-130-0x0000000000000000-mapping.dmp

  • memory/788-154-0x0000000009010000-0x0000000009043000-memory.dmp

    Filesize

    204KB

  • memory/788-143-0x0000000006CB2000-0x0000000006CB3000-memory.dmp

    Filesize

    4KB

  • memory/788-142-0x0000000007C80000-0x0000000007C81000-memory.dmp

    Filesize

    4KB

  • memory/788-368-0x00000000094C0000-0x00000000094C1000-memory.dmp

    Filesize

    4KB

  • memory/788-172-0x0000000006CB3000-0x0000000006CB4000-memory.dmp

    Filesize

    4KB

  • memory/788-141-0x0000000007B70000-0x0000000007B71000-memory.dmp

    Filesize

    4KB

  • memory/788-139-0x00000000071C0000-0x00000000071C1000-memory.dmp

    Filesize

    4KB

  • memory/788-140-0x0000000007260000-0x0000000007261000-memory.dmp

    Filesize

    4KB

  • memory/1524-128-0x0000000000000000-mapping.dmp

  • memory/2016-117-0x0000000004C30000-0x0000000004C31000-memory.dmp

    Filesize

    4KB

  • memory/2016-116-0x0000000005130000-0x0000000005131000-memory.dmp

    Filesize

    4KB

  • memory/2016-114-0x0000000000130000-0x0000000000131000-memory.dmp

    Filesize

    4KB

  • memory/2016-126-0x0000000006E10000-0x0000000006E7A000-memory.dmp

    Filesize

    424KB

  • memory/2016-121-0x0000000006E90000-0x0000000006E91000-memory.dmp

    Filesize

    4KB

  • memory/2016-127-0x00000000079D0000-0x00000000079D1000-memory.dmp

    Filesize

    4KB

  • memory/2016-120-0x0000000006C00000-0x0000000006E07000-memory.dmp

    Filesize

    2.0MB

  • memory/2016-119-0x0000000004C30000-0x000000000512E000-memory.dmp

    Filesize

    5.0MB

  • memory/2016-118-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

    Filesize

    4KB

  • memory/2140-132-0x000000000068A488-mapping.dmp

  • memory/2140-131-0x0000000000400000-0x00000000007CE000-memory.dmp

    Filesize

    3.8MB

  • memory/2140-135-0x0000000000400000-0x00000000007CE000-memory.dmp

    Filesize

    3.8MB