bitrat | 67c20680218a6e7a0f55f1fae46bc9feec46929789f9d59a70ac5fc3510b32a8

Analysis

max time kernel
150s
max time network
164s
platform
windows10_x64
resource
win10-en-20210920
submitted
27-10-2021 00:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RAXCFQVS.EXE

Score

10^/10

bitrat xenarmor collection password persistence recovery spyware stealer trojan upx

Malware Config

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3932-119-0x0000000072480000-0x0000000072864000-memory.dmp	family_bitrat
behavioral2/memory/3932-129-0x0000000072480000-0x0000000072864000-memory.dmp	family_bitrat

XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
recovery password xenarmor

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Windows\SysWOW64\Unknown.dll	acprotect
C:\Windows\SysWOW64\Unknown.dll	acprotect

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3932-119-0x0000000072480000-0x0000000072864000-memory.dmp	upx
behavioral2/memory/3932-129-0x0000000072480000-0x0000000072864000-memory.dmp	upx
behavioral2/memory/4156-133-0x0000000000400000-0x00000000008DC000-memory.dmp	upx
behavioral2/memory/4156-137-0x0000000000400000-0x00000000008DC000-memory.dmp	upx
behavioral2/memory/4156-140-0x0000000000400000-0x00000000008DC000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

mobsync.exe

pid process

5012 mobsync.exe
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
5012	mobsync.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

mobsync.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	mobsync.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RAXCFQVS.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Raxcfq = "C:\\Users\\Public\\Libraries\\\\qfcxaR.url"	RAXCFQVS.EXE

Drops file in System32 directory 26 IoCs

Processes:

mobsync.exemobsync.exe

description	ioc	process
File created	C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-convert-l1-1-0.dll	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-locale-l1-1-0.dll	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-multibyte-l1-1-0.dll	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-runtime-l1-1-0.dll	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\mozglue.dll	mobsync.exe
File created	C:\Windows\SysWOW64\Unknown.dll	mobsync.exe
File created	C:\Windows\SysWOW64\License.XenArmor	mobsync.exe
File opened for modification	C:\Windows\SysWOW64\License.XenArmor	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-utility-l1-1-0.dll	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\msvcp140.dll	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\softokn3.dll	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\vcruntime140.dll	mobsync.exe
File opened for modification	C:\Windows\SysWOW64\Unknown.dll	mobsync.exe
File created	C:\Windows\SysWOW64\License.XenArmor	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-math-l1-1-0.dll	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-time-l1-1-0.dll	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-conio-l1-1-0_not.dll	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-environment-l1-1-0.dll	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-filesystem-l1-1-0.dll	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-heap-l1-1-0.dll	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-stdio-l1-1-0.dll	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\freebl3.dll	mobsync.exe
File opened for modification	C:\Windows\SysWOW64\External	mobsync.exe
File opened for modification	C:\Windows\SysWOW64\External\ComponentsExt	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\nss3.dll	mobsync.exe
File created	C:\Windows\SysWOW64\External\ComponentsExt\api-ms-win-crt-string-l1-1-0.dll	mobsync.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

mobsync.exe

pid process

3932 mobsync.exe
3932 mobsync.exe
3932 mobsync.exe
3932 mobsync.exe
3932 mobsync.exe

pid	process
3932	mobsync.exe
3932	mobsync.exe
3932	mobsync.exe
3932	mobsync.exe
3932	mobsync.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

mobsync.exemobsync.exe

description	pid	process	target process
PID 3932 set thread context of 4156	3932	mobsync.exe	mobsync.exe
PID 4156 set thread context of 5012	4156	mobsync.exe	mobsync.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exe

pid process

908 reg.exe
416 reg.exe
1716 reg.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

mobsync.exe

pid process

5012 mobsync.exe
5012 mobsync.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

mobsync.exemobsync.exe

description pid process

Token: SeShutdownPrivilege 3932 mobsync.exe
Token: SeDebugPrivilege 5012 mobsync.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

mobsync.exe

pid process

3932 mobsync.exe
3932 mobsync.exe

pid	process
908	reg.exe
416	reg.exe
1716	reg.exe

pid	process
5012	mobsync.exe
5012	mobsync.exe

description	pid	process
Token: SeShutdownPrivilege	3932	mobsync.exe
Token: SeDebugPrivilege	5012	mobsync.exe

pid	process
3932	mobsync.exe
3932	mobsync.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

RAXCFQVS.EXEcmd.execmd.execmd.exemobsync.exemobsync.exe

description	pid	process	target process
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 3932	772	RAXCFQVS.EXE	mobsync.exe
PID 772 wrote to memory of 1940	772	RAXCFQVS.EXE	cmd.exe
PID 772 wrote to memory of 1940	772	RAXCFQVS.EXE	cmd.exe
PID 772 wrote to memory of 1940	772	RAXCFQVS.EXE	cmd.exe
PID 1940 wrote to memory of 528	1940	cmd.exe	cmd.exe
PID 1940 wrote to memory of 528	1940	cmd.exe	cmd.exe
PID 1940 wrote to memory of 528	1940	cmd.exe	cmd.exe
PID 528 wrote to memory of 908	528	cmd.exe	reg.exe
PID 528 wrote to memory of 908	528	cmd.exe	reg.exe
PID 528 wrote to memory of 908	528	cmd.exe	reg.exe
PID 528 wrote to memory of 416	528	cmd.exe	reg.exe
PID 528 wrote to memory of 416	528	cmd.exe	reg.exe
PID 528 wrote to memory of 416	528	cmd.exe	reg.exe
PID 528 wrote to memory of 1096	528	cmd.exe	schtasks.exe
PID 528 wrote to memory of 1096	528	cmd.exe	schtasks.exe
PID 528 wrote to memory of 1096	528	cmd.exe	schtasks.exe
PID 772 wrote to memory of 1544	772	RAXCFQVS.EXE	cmd.exe
PID 772 wrote to memory of 1544	772	RAXCFQVS.EXE	cmd.exe
PID 772 wrote to memory of 1544	772	RAXCFQVS.EXE	cmd.exe
PID 1544 wrote to memory of 1716	1544	cmd.exe	reg.exe
PID 1544 wrote to memory of 1716	1544	cmd.exe	reg.exe
PID 1544 wrote to memory of 1716	1544	cmd.exe	reg.exe
PID 3932 wrote to memory of 4156	3932	mobsync.exe	mobsync.exe
PID 3932 wrote to memory of 4156	3932	mobsync.exe	mobsync.exe
PID 3932 wrote to memory of 4156	3932	mobsync.exe	mobsync.exe
PID 3932 wrote to memory of 4156	3932	mobsync.exe	mobsync.exe
PID 3932 wrote to memory of 4156	3932	mobsync.exe	mobsync.exe
PID 3932 wrote to memory of 4156	3932	mobsync.exe	mobsync.exe
PID 3932 wrote to memory of 4156	3932	mobsync.exe	mobsync.exe
PID 3932 wrote to memory of 4156	3932	mobsync.exe	mobsync.exe
PID 4156 wrote to memory of 5012	4156	mobsync.exe	mobsync.exe
PID 4156 wrote to memory of 5012	4156	mobsync.exe	mobsync.exe
PID 4156 wrote to memory of 5012	4156	mobsync.exe	mobsync.exe
PID 4156 wrote to memory of 5012	4156	mobsync.exe	mobsync.exe
PID 4156 wrote to memory of 5012	4156	mobsync.exe	mobsync.exe
PID 4156 wrote to memory of 5012	4156	mobsync.exe	mobsync.exe
PID 4156 wrote to memory of 5012	4156	mobsync.exe	mobsync.exe
PID 4156 wrote to memory of 5012	4156	mobsync.exe	mobsync.exe

C:\Users\Admin\AppData\Local\Temp\RAXCFQVS.EXE
"C:\Users\Admin\AppData\Local\Temp\RAXCFQVS.EXE"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\SysWOW64\mobsync.exe
C:\Windows\System32\mobsync.exe
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932

C:\Windows\SysWOW64\mobsync.exe
-a "C:\Users\Admin\AppData\Local\1394a09b\plg\oWMq3TP0.json"
3⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4156

C:\Windows\SysWOW64\mobsync.exe
-a "C:\Users\Admin\AppData\Local\Temp\unk.xml"
4⤵
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
4⤵
- Modifies registry key
PID:908

C:\Windows\SysWOW64\reg.exe
reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
4⤵
- Modifies registry key
PID:416

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
4⤵
PID:1096

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
3⤵
- Modifies registry key
PID:1716

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\1394a09b\plg\oWMq3TP0.json
MD5
2839088c337f35edbce9721dddc514e3

SHA1
54e573718f2579b31d7fb8edd7b1e42f005e857f

SHA256
83086b306de7176597d26be3ffa5f8852b0238e5ed8880374512dc6c697a75ce

SHA512
4f47cc8de0c1bbf04c7a337bd4e52f33cf400f6a421908623806461b0a3b5488b57fb1bed8462e7e7f7037482f6ec451f8e6836867168b1f5c5d3d3ecadd2d48

Download Submit
C:\Users\Admin\AppData\Local\Temp\unk.xml
MD5
2839088c337f35edbce9721dddc514e3

SHA1
54e573718f2579b31d7fb8edd7b1e42f005e857f

SHA256
83086b306de7176597d26be3ffa5f8852b0238e5ed8880374512dc6c697a75ce

SHA512
4f47cc8de0c1bbf04c7a337bd4e52f33cf400f6a421908623806461b0a3b5488b57fb1bed8462e7e7f7037482f6ec451f8e6836867168b1f5c5d3d3ecadd2d48

Download Submit
C:\Users\Public\Trast.bat
MD5
4068c9f69fcd8a171c67f81d4a952a54

SHA1
4d2536a8c28cdcc17465e20d6693fb9e8e713b36

SHA256
24222300c78180b50ed1f8361ba63cb27316ec994c1c9079708a51b4a1a9d810

SHA512
a64f9319acc51fffd0491c74dcd9c9084c2783b82f95727e4bfe387a8528c6dcf68f11418e88f1e133d115daf907549c86dd7ad866b2a7938add5225fbb2811d

Download Submit
C:\Users\Public\UKO.bat
MD5
eaf8d967454c3bbddbf2e05a421411f8

SHA1
6170880409b24de75c2dc3d56a506fbff7f6622c

SHA256
f35f2658455a2e40f151549a7d6465a836c33fa9109e67623916f889849eac56

SHA512
fe5be5c673e99f70c93019d01abb0a29dd2ecf25b2d895190ff551f020c28e7d8f99f65007f440f0f76c5bcac343b2a179a94d190c938ea3b9e1197890a412e9

Download Submit
C:\Users\Public\nest.bat
MD5
8ada51400b7915de2124baaf75e3414c

SHA1
1a7b9db12184ab7fd7fce1c383f9670a00adb081

SHA256
45aa3957c29865260a78f03eef18ae9aebdbf7bea751ecc88be4a799f2bb46c7

SHA512
9afc138157a4565294ca49942579cdb6f5d8084e56f9354738de62b585f4c0fa3e7f2cbc9541827f2084e3ff36c46eed29b46f5dd2444062ffcd05c599992e68

Download Submit
C:\Windows\SysWOW64\License.XenArmor
MD5
4f3bde9212e17ef18226866d6ac739b6

SHA1
732733bec8314beb81437e60876ffa75e72ae6cd

SHA256
212173a405c78d70f90e8ec0699a60ed2f4a9f3a8070de62eabd666c268fb174

SHA512
10b7cdae0b9a7b0f8e1bfc66a60675fa9b25c523864d5ae3da243f4e6e4c5194f3bd92af57ac956157442f66414bdd3393d0a1e5ba4ef0f192561e8524d4e744

Download Submit
C:\Windows\SysWOW64\License.XenArmor
MD5
bf5da170f7c9a8eae88d1cb1a191ff80

SHA1
dd1b991a1b03587a5d1edc94e919a2070e325610

SHA256
e5d5110feb21939d82d962981aeaaafc4643b40a9b87cbed800ace82135d57cd

SHA512
9e32247d8556fd6efffbf7b6b9c325652d8c4b223b0fa38020879171476a49ab1f64d8897b5d8d92b79c5484fd9d5899be26ca5f664ee1f9c2acb0857084121e

Download Submit
C:\Windows\SysWOW64\Unknown.dll
MD5
86114faba7e1ec4a667d2bcb2e23f024

SHA1
670df6e1ba1dc6bece046e8b2e573dd36748245e

SHA256
568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d

SHA512
d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f

Download Submit
\Windows\SysWOW64\Unknown.dll
MD5
86114faba7e1ec4a667d2bcb2e23f024

SHA1
670df6e1ba1dc6bece046e8b2e573dd36748245e

SHA256
568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d

SHA512
d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f

Download Submit
memory/416-124-0x0000000000000000-mapping.dmp

Download
memory/528-121-0x0000000000000000-mapping.dmp

Download
memory/772-115-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/772-116-0x0000000002261000-0x0000000002275000-memory.dmp

Filesize
80KB

Download
memory/908-123-0x0000000000000000-mapping.dmp

Download
memory/1096-128-0x0000000000000000-mapping.dmp

Download
memory/1544-130-0x0000000000000000-mapping.dmp

Download
memory/1716-132-0x0000000000000000-mapping.dmp

Download
memory/1940-118-0x0000000000000000-mapping.dmp

Download
memory/3932-125-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/3932-129-0x0000000072480000-0x0000000072864000-memory.dmp

Filesize
3.9MB

Download
memory/3932-127-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/3932-126-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download
memory/3932-119-0x0000000072480000-0x0000000072864000-memory.dmp

Filesize
3.9MB

Download
memory/3932-117-0x0000000000000000-mapping.dmp

Download
memory/4156-134-0x00000000008D9FE0-mapping.dmp

Download
memory/4156-140-0x0000000000400000-0x00000000008DC000-memory.dmp

Filesize
4.9MB

Download
memory/4156-137-0x0000000000400000-0x00000000008DC000-memory.dmp

Filesize
4.9MB

Download
memory/4156-136-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

Filesize
4KB

Download
memory/4156-135-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

Filesize
4KB

Download
memory/4156-133-0x0000000000400000-0x00000000008DC000-memory.dmp

Filesize
4.9MB

Download
memory/5012-142-0x0000000002F80000-0x0000000002F81000-memory.dmp

Filesize
4KB

Download
memory/5012-141-0x0000000002F80000-0x0000000002F81000-memory.dmp

Filesize
4KB

Download
memory/5012-143-0x0000000000400000-0x00000000006FE000-memory.dmp

Filesize
3.0MB

Download
memory/5012-139-0x00000000006FC1D0-mapping.dmp

Download
memory/5012-138-0x0000000000400000-0x00000000006FE000-memory.dmp

Filesize
3.0MB

Download
memory/5012-147-0x0000000000400000-0x00000000006FE000-memory.dmp

Filesize
3.0MB

Download