Overview

overview

10

Static

static

59f5aa2f39...91.exe

windows7_x64

3

59f5aa2f39...91.exe

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    05-01-2022 19:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    59f5aa2f3938d9478d3275caaa5eda91.exe

  • Size

    271KB

  • MD5

    59f5aa2f3938d9478d3275caaa5eda91

  • SHA1

    87fddce9bdff61168e35c09c09e04378137cfabc

  • SHA256

    2bbe399540ca6bbcb26444284ed0cf85c0840a1d36c8bf3ca670be78a4975410

  • SHA512

    bb9282b6f89a5d887d84bedf9a782a5c774158aa670a17bf0d532dbaf0f9b0e3f57d7ca1bc14c9de0f46de27b08fef7bd172f018fdc9108d395859f2edb8243e

Score
10/10
bitratsuricatatrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.35

C2

storage.nsupdate.info:8973

Attributes
  • communication_password

    bf771c9d082071fe80b18bb678220682

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops startup file 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 53 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\59f5aa2f3938d9478d3275caaa5eda91.exe
    "C:\Users\Admin\AppData\Local\Temp\59f5aa2f3938d9478d3275caaa5eda91.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c Copy "C:\Users\Admin\AppData\Local\Temp\59f5aa2f3938d9478d3275caaa5eda91.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59f5aa2f3938d9478d3275caaa5eda91.exe"
      2⤵
      • Drops startup file
      PID:3260
    • C:\Users\Admin\AppData\Local\Temp\59f5aa2f3938d9478d3275caaa5eda91.exe
      "C:\Users\Admin\AppData\Local\Temp\59f5aa2f3938d9478d3275caaa5eda91.exe"
      2⤵
        PID:508
      • C:\Users\Admin\AppData\Local\Temp\59f5aa2f3938d9478d3275caaa5eda91.exe
        "C:\Users\Admin\AppData\Local\Temp\59f5aa2f3938d9478d3275caaa5eda91.exe"
        2⤵
          PID:804
        • C:\Users\Admin\AppData\Local\Temp\59f5aa2f3938d9478d3275caaa5eda91.exe
          "C:\Users\Admin\AppData\Local\Temp\59f5aa2f3938d9478d3275caaa5eda91.exe"
          2⤵
            PID:2828
          • C:\Users\Admin\AppData\Local\Temp\59f5aa2f3938d9478d3275caaa5eda91.exe
            "C:\Users\Admin\AppData\Local\Temp\59f5aa2f3938d9478d3275caaa5eda91.exe"
            2⤵
              PID:2836
            • C:\Users\Admin\AppData\Local\Temp\59f5aa2f3938d9478d3275caaa5eda91.exe
              "C:\Users\Admin\AppData\Local\Temp\59f5aa2f3938d9478d3275caaa5eda91.exe"
              2⤵
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:1500

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Privilege Escalation

          Defense Evasion

          Credential Access

          Discovery

          System Information Discovery

          1
          T1082

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59f5aa2f3938d9478d3275caaa5eda91.exe
            MD5

            59f5aa2f3938d9478d3275caaa5eda91

            SHA1

            87fddce9bdff61168e35c09c09e04378137cfabc

            SHA256

            2bbe399540ca6bbcb26444284ed0cf85c0840a1d36c8bf3ca670be78a4975410

            SHA512

            bb9282b6f89a5d887d84bedf9a782a5c774158aa670a17bf0d532dbaf0f9b0e3f57d7ca1bc14c9de0f46de27b08fef7bd172f018fdc9108d395859f2edb8243e

            Download Submit
          • memory/1500-137-0x0000000000400000-0x00000000007E4000-memory.dmp
            Filesize

            3.9MB

            Download
          • memory/1500-136-0x0000000000400000-0x00000000007E4000-memory.dmp
            Filesize

            3.9MB

            Download
          • memory/1500-135-0x00000000007E2370-mapping.dmp
            Download
          • memory/1500-134-0x0000000000400000-0x00000000007E4000-memory.dmp
            Filesize

            3.9MB

            Download
          • memory/2652-120-0x00000000052C0000-0x00000000052CA000-memory.dmp
            Filesize

            40KB

            Download
          • memory/2652-129-0x0000000006EB0000-0x0000000006EB8000-memory.dmp
            Filesize

            32KB

            Download
          • memory/2652-122-0x0000000006640000-0x00000000066DC000-memory.dmp
            Filesize

            624KB

            Download
          • memory/2652-116-0x00000000008D0000-0x000000000091A000-memory.dmp
            Filesize

            296KB

            Download
          • memory/2652-124-0x0000000006850000-0x00000000068B6000-memory.dmp
            Filesize

            408KB

            Download
          • memory/2652-115-0x00000000008D0000-0x000000000091A000-memory.dmp
            Filesize

            296KB

            Download
          • memory/2652-126-0x00000000068C0000-0x00000000068C8000-memory.dmp
            Filesize

            32KB

            Download
          • memory/2652-127-0x0000000006E90000-0x0000000006E98000-memory.dmp
            Filesize

            32KB

            Download
          • memory/2652-128-0x0000000006EA0000-0x0000000006EA8000-memory.dmp
            Filesize

            32KB

            Download
          • memory/2652-121-0x0000000006310000-0x0000000006496000-memory.dmp
            Filesize

            1.5MB

            Download
          • memory/2652-130-0x0000000006EC0000-0x0000000006EC8000-memory.dmp
            Filesize

            32KB

            Download
          • memory/2652-131-0x0000000006ED0000-0x0000000006ED8000-memory.dmp
            Filesize

            32KB

            Download
          • memory/2652-132-0x0000000006EE0000-0x0000000006EE8000-memory.dmp
            Filesize

            32KB

            Download
          • memory/2652-133-0x0000000006EF0000-0x0000000006EF8000-memory.dmp
            Filesize

            32KB

            Download
          • memory/2652-119-0x0000000005090000-0x000000000558E000-memory.dmp
            Filesize

            5.0MB

            Download
          • memory/2652-118-0x0000000005150000-0x00000000051E2000-memory.dmp
            Filesize

            584KB

            Download
          • memory/2652-117-0x0000000005590000-0x0000000005A8E000-memory.dmp
            Filesize

            5.0MB

            Download
          • memory/3260-123-0x0000000000000000-mapping.dmp
            Download