2.exe

General
Target

2.exe

Filesize

785KB

Completed

06-01-2022 09:13

Score
10/10
MD5

751cfacd6de472704d072d56cd27769e

SHA1

733fd283e27fedb060e4b841f4737a28ba126600

SHA256

1df11ec4ef8cfeda563e1103d5e0cdc4ed10601b37e0ea9f93be82433ab68c72

Malware Config

Extracted

Family bitrat
Version 1.38
C2

severdops.ddns.net:3071

Attributes
communication_password
29ef52e7563626a96cea7f4b4085c124
tor_process
tor
Signatures 16

Filter: none

Defense Evasion
Discovery
Persistence
  • BitRAT

    Description

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Windows security bypass

    TTPs

    Disabling Security ToolsModify Registry
  • Downloads MZ/PE file
  • Executes dropped EXE
    rkF4alM9xO3IvYKF.exe

    Reported IOCs

    pidprocess
    1968rkF4alM9xO3IvYKF.exe
  • UPX packed file

    Description

    Detects executables packed with UPX/modified UPX open source packer.

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1936-95-0x0000000000400000-0x00000000007E5000-memory.dmpupx
    behavioral1/memory/1936-96-0x0000000000400000-0x00000000007E5000-memory.dmpupx
    behavioral1/memory/1936-97-0x0000000000400000-0x00000000007E5000-memory.dmpupx
    behavioral1/memory/1936-101-0x0000000000400000-0x00000000007E5000-memory.dmpupx
    behavioral1/memory/1936-98-0x0000000000400000-0x00000000007E5000-memory.dmpupx
    behavioral1/memory/1936-103-0x0000000000400000-0x00000000007E5000-memory.dmpupx
  • Loads dropped DLL
    2.exe

    Reported IOCs

    pidprocess
    1082.exe
    1082.exe
    1082.exe
    1082.exe
    1082.exe
  • Windows security modification
    rkF4alM9xO3IvYKF.exe

    TTPs

    Disabling Security ToolsModify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\PathsrkF4alM9xO3IvYKF.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\ExclusionsrkF4alM9xO3IvYKF.exe
    Set value (int)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Resources\Themes\SHININESSESAAC\svchost.exe = "0"rkF4alM9xO3IvYKF.exe
    Set value (int)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\rkF4alM9xO3IvYKF.exe = "0"rkF4alM9xO3IvYKF.exe
  • Adds Run key to start application
    rkF4alM9xO3IvYKF.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\TALISMANSCBF = "C:\\Windows\\Resources\\Themes\\SHININESSESAAC\\svchost.exe"rkF4alM9xO3IvYKF.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\TALISMANSCBF = "C:\\Windows\\Resources\\Themes\\SHININESSESAAC\\svchost.exe"rkF4alM9xO3IvYKF.exe
  • Suspicious use of NtSetInformationThreadHideFromDebugger
    ServiceModelReg.exe

    Reported IOCs

    pidprocess
    1936ServiceModelReg.exe
    1936ServiceModelReg.exe
    1936ServiceModelReg.exe
    1936ServiceModelReg.exe
    1936ServiceModelReg.exe
  • Suspicious use of SetThreadContext
    2.exerkF4alM9xO3IvYKF.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1932 set thread context of 10819322.exe2.exe
    PID 1968 set thread context of 19361968rkF4alM9xO3IvYKF.exeServiceModelReg.exe
  • Drops file in Windows directory
    rkF4alM9xO3IvYKF.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\Resources\Themes\SHININESSESAAC\svchost.exerkF4alM9xO3IvYKF.exe
    File opened for modificationC:\Windows\Resources\Themes\SHININESSESAACrkF4alM9xO3IvYKF.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious behavior: EnumeratesProcesses
    rkF4alM9xO3IvYKF.exepowershell.exepowershell.exepowershell.exe

    Reported IOCs

    pidprocess
    1968rkF4alM9xO3IvYKF.exe
    1968rkF4alM9xO3IvYKF.exe
    1968rkF4alM9xO3IvYKF.exe
    1968rkF4alM9xO3IvYKF.exe
    1968rkF4alM9xO3IvYKF.exe
    1968rkF4alM9xO3IvYKF.exe
    1968rkF4alM9xO3IvYKF.exe
    1968rkF4alM9xO3IvYKF.exe
    916powershell.exe
    1748powershell.exe
    920powershell.exe
    1968rkF4alM9xO3IvYKF.exe
    1968rkF4alM9xO3IvYKF.exe
  • Suspicious use of AdjustPrivilegeToken
    rkF4alM9xO3IvYKF.exepowershell.exepowershell.exepowershell.exeServiceModelReg.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1968rkF4alM9xO3IvYKF.exe
    Token: SeDebugPrivilege916powershell.exe
    Token: SeDebugPrivilege1748powershell.exe
    Token: SeDebugPrivilege920powershell.exe
    Token: SeDebugPrivilege1936ServiceModelReg.exe
    Token: SeShutdownPrivilege1936ServiceModelReg.exe
  • Suspicious use of SetWindowsHookEx
    ServiceModelReg.exe

    Reported IOCs

    pidprocess
    1936ServiceModelReg.exe
    1936ServiceModelReg.exe
  • Suspicious use of WriteProcessMemory
    2.exe2.exerkF4alM9xO3IvYKF.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1932 wrote to memory of 10819322.exe2.exe
    PID 1932 wrote to memory of 10819322.exe2.exe
    PID 1932 wrote to memory of 10819322.exe2.exe
    PID 1932 wrote to memory of 10819322.exe2.exe
    PID 1932 wrote to memory of 10819322.exe2.exe
    PID 1932 wrote to memory of 10819322.exe2.exe
    PID 1932 wrote to memory of 10819322.exe2.exe
    PID 1932 wrote to memory of 10819322.exe2.exe
    PID 1932 wrote to memory of 10819322.exe2.exe
    PID 1932 wrote to memory of 10819322.exe2.exe
    PID 1932 wrote to memory of 10819322.exe2.exe
    PID 1932 wrote to memory of 10819322.exe2.exe
    PID 108 wrote to memory of 19681082.exerkF4alM9xO3IvYKF.exe
    PID 108 wrote to memory of 19681082.exerkF4alM9xO3IvYKF.exe
    PID 108 wrote to memory of 19681082.exerkF4alM9xO3IvYKF.exe
    PID 108 wrote to memory of 19681082.exerkF4alM9xO3IvYKF.exe
    PID 1968 wrote to memory of 17481968rkF4alM9xO3IvYKF.exepowershell.exe
    PID 1968 wrote to memory of 17481968rkF4alM9xO3IvYKF.exepowershell.exe
    PID 1968 wrote to memory of 17481968rkF4alM9xO3IvYKF.exepowershell.exe
    PID 1968 wrote to memory of 17481968rkF4alM9xO3IvYKF.exepowershell.exe
    PID 1968 wrote to memory of 9201968rkF4alM9xO3IvYKF.exepowershell.exe
    PID 1968 wrote to memory of 9201968rkF4alM9xO3IvYKF.exepowershell.exe
    PID 1968 wrote to memory of 9201968rkF4alM9xO3IvYKF.exepowershell.exe
    PID 1968 wrote to memory of 9201968rkF4alM9xO3IvYKF.exepowershell.exe
    PID 1968 wrote to memory of 9161968rkF4alM9xO3IvYKF.exepowershell.exe
    PID 1968 wrote to memory of 9161968rkF4alM9xO3IvYKF.exepowershell.exe
    PID 1968 wrote to memory of 9161968rkF4alM9xO3IvYKF.exepowershell.exe
    PID 1968 wrote to memory of 9161968rkF4alM9xO3IvYKF.exepowershell.exe
    PID 1968 wrote to memory of 19361968rkF4alM9xO3IvYKF.exeServiceModelReg.exe
    PID 1968 wrote to memory of 19361968rkF4alM9xO3IvYKF.exeServiceModelReg.exe
    PID 1968 wrote to memory of 19361968rkF4alM9xO3IvYKF.exeServiceModelReg.exe
    PID 1968 wrote to memory of 19361968rkF4alM9xO3IvYKF.exeServiceModelReg.exe
    PID 1968 wrote to memory of 19361968rkF4alM9xO3IvYKF.exeServiceModelReg.exe
    PID 1968 wrote to memory of 19361968rkF4alM9xO3IvYKF.exeServiceModelReg.exe
    PID 1968 wrote to memory of 19361968rkF4alM9xO3IvYKF.exeServiceModelReg.exe
    PID 1968 wrote to memory of 19361968rkF4alM9xO3IvYKF.exeServiceModelReg.exe
    PID 1968 wrote to memory of 19361968rkF4alM9xO3IvYKF.exeServiceModelReg.exe
    PID 1968 wrote to memory of 19361968rkF4alM9xO3IvYKF.exeServiceModelReg.exe
    PID 1968 wrote to memory of 19361968rkF4alM9xO3IvYKF.exeServiceModelReg.exe
    PID 1968 wrote to memory of 19361968rkF4alM9xO3IvYKF.exeServiceModelReg.exe
Processes 7
  • C:\Users\Admin\AppData\Local\Temp\2.exe
    "C:\Users\Admin\AppData\Local\Temp\2.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Users\Admin\AppData\Local\Temp\2.exe
      "C:\Users\Admin\AppData\Local\Temp\2.exe"
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:108
      • C:\Users\Admin\AppData\Local\Temp\rkF4alM9xO3IvYKF.exe
        "C:\Users\Admin\AppData\Local\Temp\rkF4alM9xO3IvYKF.exe"
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\SHININESSESAAC\svchost.exe" -Force
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          PID:1748
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\SHININESSESAAC\svchost.exe" -Force
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          PID:920
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\rkF4alM9xO3IvYKF.exe" -Force
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          PID:916
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe"
          Suspicious use of NtSetInformationThreadHideFromDebugger
          Suspicious use of AdjustPrivilegeToken
          Suspicious use of SetWindowsHookEx
          PID:1936
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Users\Admin\AppData\Local\Temp\rkF4alM9xO3IvYKF.exe

                      MD5

                      8725525b3969fc1c1e01f8ec7eab1ed9

                      SHA1

                      0672c99376928faba1db5add67833606e0d73529

                      SHA256

                      58004218b37d36f47da2c5946cac4693e9aea741a0b3a02b823862aec085454b

                      SHA512

                      5f7b18430aee1e18ecf32eec5d825f7473258a715143df64c19ed703e011a7cf9da40815c4e2b4ea8677c1e6b97dfe0fd74079eaedd102ec2f801776c851cb85

                    • C:\Users\Admin\AppData\Local\Temp\rkF4alM9xO3IvYKF.exe

                      MD5

                      8725525b3969fc1c1e01f8ec7eab1ed9

                      SHA1

                      0672c99376928faba1db5add67833606e0d73529

                      SHA256

                      58004218b37d36f47da2c5946cac4693e9aea741a0b3a02b823862aec085454b

                      SHA512

                      5f7b18430aee1e18ecf32eec5d825f7473258a715143df64c19ed703e011a7cf9da40815c4e2b4ea8677c1e6b97dfe0fd74079eaedd102ec2f801776c851cb85

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                      MD5

                      a58a6d5b117cd64d3c7e3b7d86eb4ec6

                      SHA1

                      88e87edf7df5604a3b404b0826055f45dcd139e9

                      SHA256

                      b5df54907ca49c7689c593089ea2205c62726c32cd41dcaa31cdcd4c1a880c5f

                      SHA512

                      6364db98f2e2d708898b0306308db6151588991453d894ada83a4571552e1d8891983ced5e1b91e31a9cdb784c1305467649064c64e11a754192e5b3ce27432b

                    • \Users\Admin\AppData\Local\Temp\rkF4alM9xO3IvYKF.exe

                      MD5

                      8725525b3969fc1c1e01f8ec7eab1ed9

                      SHA1

                      0672c99376928faba1db5add67833606e0d73529

                      SHA256

                      58004218b37d36f47da2c5946cac4693e9aea741a0b3a02b823862aec085454b

                      SHA512

                      5f7b18430aee1e18ecf32eec5d825f7473258a715143df64c19ed703e011a7cf9da40815c4e2b4ea8677c1e6b97dfe0fd74079eaedd102ec2f801776c851cb85

                    • \Users\Admin\AppData\Local\Temp\rkF4alM9xO3IvYKF.exe

                      MD5

                      8725525b3969fc1c1e01f8ec7eab1ed9

                      SHA1

                      0672c99376928faba1db5add67833606e0d73529

                      SHA256

                      58004218b37d36f47da2c5946cac4693e9aea741a0b3a02b823862aec085454b

                      SHA512

                      5f7b18430aee1e18ecf32eec5d825f7473258a715143df64c19ed703e011a7cf9da40815c4e2b4ea8677c1e6b97dfe0fd74079eaedd102ec2f801776c851cb85

                    • \Users\Admin\AppData\Local\Temp\rkF4alM9xO3IvYKF.exe

                      MD5

                      8725525b3969fc1c1e01f8ec7eab1ed9

                      SHA1

                      0672c99376928faba1db5add67833606e0d73529

                      SHA256

                      58004218b37d36f47da2c5946cac4693e9aea741a0b3a02b823862aec085454b

                      SHA512

                      5f7b18430aee1e18ecf32eec5d825f7473258a715143df64c19ed703e011a7cf9da40815c4e2b4ea8677c1e6b97dfe0fd74079eaedd102ec2f801776c851cb85

                    • \Users\Admin\AppData\Local\Temp\rkF4alM9xO3IvYKF.exe

                      MD5

                      8725525b3969fc1c1e01f8ec7eab1ed9

                      SHA1

                      0672c99376928faba1db5add67833606e0d73529

                      SHA256

                      58004218b37d36f47da2c5946cac4693e9aea741a0b3a02b823862aec085454b

                      SHA512

                      5f7b18430aee1e18ecf32eec5d825f7473258a715143df64c19ed703e011a7cf9da40815c4e2b4ea8677c1e6b97dfe0fd74079eaedd102ec2f801776c851cb85

                    • \Users\Admin\AppData\Local\Temp\rkF4alM9xO3IvYKF.exe

                      MD5

                      8725525b3969fc1c1e01f8ec7eab1ed9

                      SHA1

                      0672c99376928faba1db5add67833606e0d73529

                      SHA256

                      58004218b37d36f47da2c5946cac4693e9aea741a0b3a02b823862aec085454b

                      SHA512

                      5f7b18430aee1e18ecf32eec5d825f7473258a715143df64c19ed703e011a7cf9da40815c4e2b4ea8677c1e6b97dfe0fd74079eaedd102ec2f801776c851cb85

                    • memory/108-62-0x0000000000400000-0x000000000043F000-memory.dmp

                    • memory/108-63-0x0000000000400000-0x000000000043F000-memory.dmp

                    • memory/108-64-0x0000000000400000-0x000000000043F000-memory.dmp

                    • memory/108-66-0x0000000000400000-0x000000000043F000-memory.dmp

                    • memory/108-61-0x0000000000400000-0x000000000043F000-memory.dmp

                    • memory/108-69-0x000000000040AE9E-mapping.dmp

                    • memory/108-68-0x0000000000400000-0x000000000043F000-memory.dmp

                    • memory/108-71-0x0000000000400000-0x000000000043F000-memory.dmp

                    • memory/108-65-0x0000000000400000-0x000000000043F000-memory.dmp

                    • memory/108-67-0x0000000000400000-0x000000000043F000-memory.dmp

                    • memory/916-108-0x00000000025D2000-0x00000000025D4000-memory.dmp

                    • memory/916-100-0x00000000025D0000-0x00000000025D1000-memory.dmp

                    • memory/916-89-0x0000000000000000-mapping.dmp

                    • memory/916-107-0x00000000025D1000-0x00000000025D2000-memory.dmp

                    • memory/920-105-0x00000000023A0000-0x0000000002FEA000-memory.dmp

                    • memory/920-110-0x00000000023A0000-0x0000000002FEA000-memory.dmp

                    • memory/920-88-0x0000000000000000-mapping.dmp

                    • memory/920-111-0x00000000023A0000-0x0000000002FEA000-memory.dmp

                    • memory/1748-109-0x0000000000212000-0x0000000000214000-memory.dmp

                    • memory/1748-106-0x0000000000211000-0x0000000000212000-memory.dmp

                    • memory/1748-87-0x0000000000000000-mapping.dmp

                    • memory/1748-104-0x0000000000210000-0x0000000000211000-memory.dmp

                    • memory/1932-56-0x00000000002D0000-0x000000000039A000-memory.dmp

                    • memory/1932-57-0x0000000076511000-0x0000000076513000-memory.dmp

                    • memory/1932-58-0x0000000002070000-0x0000000002071000-memory.dmp

                    • memory/1932-59-0x0000000002040000-0x000000000204C000-memory.dmp

                    • memory/1932-55-0x00000000002D0000-0x000000000039A000-memory.dmp

                    • memory/1932-60-0x0000000005D90000-0x0000000005E06000-memory.dmp

                    • memory/1936-103-0x0000000000400000-0x00000000007E5000-memory.dmp

                    • memory/1936-96-0x0000000000400000-0x00000000007E5000-memory.dmp

                    • memory/1936-95-0x0000000000400000-0x00000000007E5000-memory.dmp

                    • memory/1936-99-0x00000000007E2730-mapping.dmp

                    • memory/1936-101-0x0000000000400000-0x00000000007E5000-memory.dmp

                    • memory/1936-94-0x0000000000400000-0x00000000007E5000-memory.dmp

                    • memory/1936-98-0x0000000000400000-0x00000000007E5000-memory.dmp

                    • memory/1936-97-0x0000000000400000-0x00000000007E5000-memory.dmp

                    • memory/1968-77-0x0000000000000000-mapping.dmp

                    • memory/1968-83-0x0000000000290000-0x0000000000298000-memory.dmp

                    • memory/1968-86-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

                    • memory/1968-85-0x00000000004E0000-0x0000000000536000-memory.dmp

                    • memory/1968-84-0x0000000006140000-0x000000000634A000-memory.dmp

                    • memory/1968-82-0x0000000000280000-0x0000000000288000-memory.dmp

                    • memory/1968-80-0x00000000002B0000-0x00000000004D6000-memory.dmp

                    • memory/1968-81-0x0000000000260000-0x0000000000268000-memory.dmp