Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    30-12-2021 07:41

General

  • Target

    5a6bf2c5bcad6098f5eed902fd2ab165.exe

  • Size

    2.6MB

  • MD5

    5a6bf2c5bcad6098f5eed902fd2ab165

  • SHA1

    169330abce1185aad9001fd590f8ea6952234a85

  • SHA256

    06d093a1f7775df0391176bdee9e23b9856f95e0baa25c9d271e1854094235a2

  • SHA512

    15821189aa69e7a35c6368c0898c7532f9cf43287ba4c6ace4c09885a2d175b9fbafc0cd6b463bfbc2ca721f1463a3904800fcee1133093d4802235072de35c1

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

178.20.40.235:7777

Attributes
  • communication_password

    90518ace97affc6b80a96099c2928d6a

  • install_dir

    Temp

  • install_file

    $77lsass.exe

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: RenamesItself 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a6bf2c5bcad6098f5eed902fd2ab165.exe
    "C:\Users\Admin\AppData\Local\Temp\5a6bf2c5bcad6098f5eed902fd2ab165.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Users\Admin\AppData\Local\Temp\5a6bf2c5bcad6098f5eed902fd2ab165.exe
      "C:\Users\Admin\AppData\Local\Temp\5a6bf2c5bcad6098f5eed902fd2ab165.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1828

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1720-75-0x0000000000329000-0x000000000032B000-memory.dmp
    Filesize

    8KB

  • memory/1720-89-0x0000000000329000-0x000000000032B000-memory.dmp
    Filesize

    8KB

  • memory/1720-56-0x000000000031C000-0x000000000031E000-memory.dmp
    Filesize

    8KB

  • memory/1720-57-0x000000000031C000-0x000000000031E000-memory.dmp
    Filesize

    8KB

  • memory/1720-59-0x000000000031E000-0x000000000031F000-memory.dmp
    Filesize

    4KB

  • memory/1720-60-0x00000000001C0000-0x00000000001C1000-memory.dmp
    Filesize

    4KB

  • memory/1720-73-0x000000000031F000-0x0000000000324000-memory.dmp
    Filesize

    20KB

  • memory/1720-62-0x000000000031F000-0x0000000000324000-memory.dmp
    Filesize

    20KB

  • memory/1720-63-0x0000000000318000-0x0000000000319000-memory.dmp
    Filesize

    4KB

  • memory/1720-64-0x0000000000329000-0x000000000032B000-memory.dmp
    Filesize

    8KB

  • memory/1720-65-0x0000000000329000-0x000000000032B000-memory.dmp
    Filesize

    8KB

  • memory/1720-66-0x000000000031F000-0x0000000000324000-memory.dmp
    Filesize

    20KB

  • memory/1720-67-0x000000000031F000-0x0000000000324000-memory.dmp
    Filesize

    20KB

  • memory/1720-68-0x000000000031F000-0x0000000000324000-memory.dmp
    Filesize

    20KB

  • memory/1720-69-0x0000000000329000-0x000000000032B000-memory.dmp
    Filesize

    8KB

  • memory/1720-70-0x0000000000329000-0x000000000032B000-memory.dmp
    Filesize

    8KB

  • memory/1720-71-0x0000000000329000-0x000000000032B000-memory.dmp
    Filesize

    8KB

  • memory/1720-54-0x00000000001B0000-0x00000000001B6000-memory.dmp
    Filesize

    24KB

  • memory/1720-61-0x000000000031F000-0x0000000000324000-memory.dmp
    Filesize

    20KB

  • memory/1720-55-0x00000000001B0000-0x00000000001BA000-memory.dmp
    Filesize

    40KB

  • memory/1720-72-0x000000000031F000-0x0000000000324000-memory.dmp
    Filesize

    20KB

  • memory/1720-76-0x0000000000329000-0x000000000032B000-memory.dmp
    Filesize

    8KB

  • memory/1720-78-0x000000000031F000-0x0000000000324000-memory.dmp
    Filesize

    20KB

  • memory/1720-77-0x0000000000329000-0x000000000032B000-memory.dmp
    Filesize

    8KB

  • memory/1720-79-0x000000000031F000-0x0000000000324000-memory.dmp
    Filesize

    20KB

  • memory/1720-80-0x000000000031F000-0x0000000000324000-memory.dmp
    Filesize

    20KB

  • memory/1720-81-0x0000000000329000-0x000000000032B000-memory.dmp
    Filesize

    8KB

  • memory/1720-82-0x0000000000329000-0x000000000032B000-memory.dmp
    Filesize

    8KB

  • memory/1720-83-0x0000000000329000-0x000000000032B000-memory.dmp
    Filesize

    8KB

  • memory/1720-84-0x000000000031F000-0x0000000000324000-memory.dmp
    Filesize

    20KB

  • memory/1720-85-0x000000000031F000-0x0000000000324000-memory.dmp
    Filesize

    20KB

  • memory/1720-86-0x000000000031F000-0x0000000000324000-memory.dmp
    Filesize

    20KB

  • memory/1720-87-0x0000000000329000-0x000000000032B000-memory.dmp
    Filesize

    8KB

  • memory/1720-88-0x0000000000329000-0x000000000032B000-memory.dmp
    Filesize

    8KB

  • memory/1720-74-0x000000000031F000-0x0000000000324000-memory.dmp
    Filesize

    20KB

  • memory/1720-93-0x0000000000290000-0x0000000000292000-memory.dmp
    Filesize

    8KB

  • memory/1828-92-0x0000000075601000-0x0000000075603000-memory.dmp
    Filesize

    8KB

  • memory/1828-94-0x0000000000400000-0x00000000007CE000-memory.dmp
    Filesize

    3.8MB

  • memory/1828-91-0x000000000068A488-mapping.dmp
  • memory/1828-95-0x0000000000030000-0x0000000000031000-memory.dmp
    Filesize

    4KB