Document.exe

General
Target

Document.exe

Filesize

435KB

Completed

12-01-2022 17:49

Score
10/10
MD5

12103b3952c09d930bf11af9df5b3ac4

SHA1

914ec6513405dfe91192ed9ae2e82c9fe32c366a

SHA256

4da51788f3414e7329cf4b720086550d686fa3d557c86b573a1eb0b218403c5f

Malware Config

Extracted

Family bitrat
Version 1.38
C2

covid1987.ddns.net:9090
Attributes
communication_password
b4df9f494056d51f86c7f1a89850c467
tor_process
tor
Signatures 8

Filter: none

  • BitRAT

    Description

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    Tags

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    Description

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    Tags

  • Downloads MZ/PE file
  • Suspicious use of NtSetInformationThreadHideFromDebugger
    RegAsm.exe

    Reported IOCs

    pidprocess
    1148RegAsm.exe
    1148RegAsm.exe
    1148RegAsm.exe
    1148RegAsm.exe
    1148RegAsm.exe
  • Suspicious use of SetThreadContext
    Document.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 792 set thread context of 1148792Document.exeRegAsm.exe
  • Suspicious use of AdjustPrivilegeToken
    Document.exeRegAsm.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege792Document.exe
    Token: SeDebugPrivilege1148RegAsm.exe
    Token: SeShutdownPrivilege1148RegAsm.exe
  • Suspicious use of SetWindowsHookEx
    RegAsm.exe

    Reported IOCs

    pidprocess
    1148RegAsm.exe
    1148RegAsm.exe
  • Suspicious use of WriteProcessMemory
    Document.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 792 wrote to memory of 1148792Document.exeRegAsm.exe
    PID 792 wrote to memory of 1148792Document.exeRegAsm.exe
    PID 792 wrote to memory of 1148792Document.exeRegAsm.exe
    PID 792 wrote to memory of 1148792Document.exeRegAsm.exe
    PID 792 wrote to memory of 1148792Document.exeRegAsm.exe
    PID 792 wrote to memory of 1148792Document.exeRegAsm.exe
    PID 792 wrote to memory of 1148792Document.exeRegAsm.exe
    PID 792 wrote to memory of 1148792Document.exeRegAsm.exe
    PID 792 wrote to memory of 1148792Document.exeRegAsm.exe
    PID 792 wrote to memory of 1148792Document.exeRegAsm.exe
    PID 792 wrote to memory of 1148792Document.exeRegAsm.exe
    PID 792 wrote to memory of 1148792Document.exeRegAsm.exe
    PID 792 wrote to memory of 1148792Document.exeRegAsm.exe
    PID 792 wrote to memory of 1148792Document.exeRegAsm.exe
    PID 792 wrote to memory of 1148792Document.exeRegAsm.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\Document.exe
    "C:\Users\Admin\AppData\Local\Temp\Document.exe"
    Suspicious use of SetThreadContext
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:792
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1148
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/792-55-0x0000000000D50000-0x0000000000DC4000-memory.dmp

                            Download

                          • memory/792-56-0x0000000000D50000-0x0000000000DC4000-memory.dmp

                            Download

                          • memory/792-57-0x0000000075321000-0x0000000075323000-memory.dmp

                            Download

                          • memory/792-58-0x0000000004D60000-0x0000000004D61000-memory.dmp

                            Download

                          • memory/792-59-0x0000000004D65000-0x0000000004D76000-memory.dmp

                            Download

                          • memory/792-60-0x00000000009F0000-0x0000000000A16000-memory.dmp

                            Download

                          • memory/1148-63-0x0000000000400000-0x00000000007CE000-memory.dmp

                            Download

                          • memory/1148-62-0x0000000000400000-0x00000000007CE000-memory.dmp

                            Download

                          • memory/1148-61-0x0000000000400000-0x00000000007CE000-memory.dmp

                            Download

                          • memory/1148-64-0x0000000000400000-0x00000000007CE000-memory.dmp

                            Download

                          • memory/1148-65-0x0000000000400000-0x00000000007CE000-memory.dmp

                            Download

                          • memory/1148-66-0x0000000000400000-0x00000000007CE000-memory.dmp

                            Download

                          • memory/1148-67-0x0000000000400000-0x00000000007CE000-memory.dmp

                            Download

                          • memory/1148-68-0x0000000000400000-0x00000000007CE000-memory.dmp

                            Download

                          • memory/1148-69-0x000000000068A488-mapping.dmp

                            Download

                          • memory/1148-71-0x0000000000400000-0x00000000007CE000-memory.dmp

                            Download

                          • memory/1148-72-0x0000000000400000-0x00000000007CE000-memory.dmp

                            Download