Overview

overview

10

Static

static

dridex

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    07-12-2021 22:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9b7a42def14129b70c89d87853845f8c21fe04c6787757d3e59d6bd1ee21234d.exe

  • Size

    555KB

  • MD5

    8c010d565f0ae6ae084bdeb35fba7ff1

  • SHA1

    95485abfab63edbd848f3f3ec2821f50aba0b74d

  • SHA256

    9b7a42def14129b70c89d87853845f8c21fe04c6787757d3e59d6bd1ee21234d

  • SHA512

    73fa980b534c6ad3af0752b5eb775652d5cada3ed66fabdeceec74d6cfe9de01db9f7f7788612d77c9ad3270ed3c8b6c16131ccffe0207b8b7f8714d0f725215

Score
10/10
bitratpersistencetrojan

Malware Config

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • BitRAT Payload 4 IoCs
  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 10 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b7a42def14129b70c89d87853845f8c21fe04c6787757d3e59d6bd1ee21234d.exe
    "C:\Users\Admin\AppData\Local\Temp\9b7a42def14129b70c89d87853845f8c21fe04c6787757d3e59d6bd1ee21234d.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'HWMonitor';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'HWMonitor' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vlc\chome_exe.exe"' -PropertyType 'String'
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3576
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2748
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1844
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          3⤵
          • Enumerates connected drives
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2832
          • C:\Windows\system32\ctfmon.exe
            ctfmon.exe
            4⤵
              PID:2244
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3828
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                5⤵
                • Checks processor information in registry
                • Modifies registry class
                PID:1532
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1532.0.1758640288\1090524860" -parentBuildID 20200403170909 -prefsHandle 1524 -prefMapHandle 1516 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1532 "\\.\pipe\gecko-crash-server-pipe.1532" 1604 gpu
                  6⤵
                    PID:3144
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1532.3.889132190\1911702480" -childID 1 -isForBrowser -prefsHandle 2088 -prefMapHandle 2224 -prefsLen 156 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1532 "\\.\pipe\gecko-crash-server-pipe.1532" 2104 tab
                    6⤵
                      PID:1244
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1532.13.1242781933\1598691934" -childID 2 -isForBrowser -prefsHandle 3416 -prefMapHandle 3412 -prefsLen 7013 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1532 "\\.\pipe\gecko-crash-server-pipe.1532" 3376 tab
                      6⤵
                        PID:3784
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1532.20.2100178003\1695601037" -childID 3 -isForBrowser -prefsHandle 4596 -prefMapHandle 4576 -prefsLen 7718 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1532 "\\.\pipe\gecko-crash-server-pipe.1532" 4556 tab
                        6⤵
                          PID:4436
              • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
                1⤵
                • Drops file in Windows directory
                • Enumerates system info in registry
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:3300
              • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
                "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
                1⤵
                • Drops file in Windows directory
                • Suspicious use of SetWindowsHookEx
                PID:3220

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Initial Access

              Execution

              Persistence

              Registry Run Keys / Startup Folder

              2
              T1060

              Privilege Escalation

              Defense Evasion

              Modify Registry

              2
              T1112

              Credential Access

              Discovery

              Query Registry

              4
              T1012

              Peripheral Device Discovery

              2
              T1120

              System Information Discovery

              4
              T1082

              Lateral Movement

              Collection

              Exfiltration

              Command and Control

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/1844-139-0x0000000000400000-0x00000000007CE000-memory.dmp
                Filesize

                3.8MB

                Download
              • memory/1844-132-0x000000000068A488-mapping.dmp
                Download
              • memory/1844-131-0x0000000000400000-0x00000000007CE000-memory.dmp
                Filesize

                3.8MB

                Download
              • memory/1844-144-0x0000000000400000-0x00000000007CE000-memory.dmp
                Filesize

                3.8MB

                Download
              • memory/2120-125-0x0000000002810000-0x0000000002811000-memory.dmp
                Filesize

                4KB

                Download
              • memory/2120-124-0x000000001C100000-0x000000001C4C6000-memory.dmp
                Filesize

                3.8MB

                Download
              • memory/2120-123-0x000000001BF80000-0x000000001BF81000-memory.dmp
                Filesize

                4KB

                Download
              • memory/2120-118-0x0000000000580000-0x0000000000581000-memory.dmp
                Filesize

                4KB

                Download
              • memory/2120-122-0x000000001BAA0000-0x000000001BE68000-memory.dmp
                Filesize

                3.8MB

                Download
              • memory/2120-121-0x0000000000E30000-0x0000000000E32000-memory.dmp
                Filesize

                8KB

                Download
              • memory/2120-120-0x0000000000D00000-0x0000000000D0D000-memory.dmp
                Filesize

                52KB

                Download
              • memory/2244-151-0x0000000000000000-mapping.dmp
                Download
              • memory/2832-152-0x0000000003160000-0x0000000003161000-memory.dmp
                Filesize

                4KB

                Download
              • memory/2832-150-0x0000000000000000-mapping.dmp
                Download
              • memory/3576-126-0x0000000000000000-mapping.dmp
                Download
              • memory/3576-134-0x00000276F0BD0000-0x00000276F0BD2000-memory.dmp
                Filesize

                8KB

                Download
              • memory/3576-135-0x00000276F0BD3000-0x00000276F0BD5000-memory.dmp
                Filesize

                8KB

                Download
              • memory/3576-136-0x00000276F0AE0000-0x00000276F0AE2000-memory.dmp
                Filesize

                8KB

                Download
              • memory/3576-137-0x00000276F0AE0000-0x00000276F0AE2000-memory.dmp
                Filesize

                8KB

                Download
              • memory/3576-133-0x00000276F2A00000-0x00000276F2A01000-memory.dmp
                Filesize

                4KB

                Download
              • memory/3576-140-0x00000276F0AE0000-0x00000276F0AE2000-memory.dmp
                Filesize

                8KB

                Download
              • memory/3576-130-0x00000276F0AE0000-0x00000276F0AE2000-memory.dmp
                Filesize

                8KB

                Download
              • memory/3576-147-0x00000276F0AE0000-0x00000276F0AE2000-memory.dmp
                Filesize

                8KB

                Download
              • memory/3576-148-0x00000276F0BD6000-0x00000276F0BD8000-memory.dmp
                Filesize

                8KB

                Download
              • memory/3576-149-0x00000276F0BD8000-0x00000276F0BD9000-memory.dmp
                Filesize

                4KB

                Download
              • memory/3576-129-0x00000276F0AE0000-0x00000276F0AE2000-memory.dmp
                Filesize

                8KB

                Download
              • memory/3576-128-0x00000276F0AE0000-0x00000276F0AE2000-memory.dmp
                Filesize

                8KB

                Download
              • memory/3576-127-0x00000276F0AE0000-0x00000276F0AE2000-memory.dmp
                Filesize

                8KB

                Download