Document.exe

General
Target

Document.exe

Filesize

435KB

Completed

12-01-2022 17:49

Score
10/10
MD5

12103b3952c09d930bf11af9df5b3ac4

SHA1

914ec6513405dfe91192ed9ae2e82c9fe32c366a

SHA256

4da51788f3414e7329cf4b720086550d686fa3d557c86b573a1eb0b218403c5f

Malware Config

Extracted

Family bitrat
Version 1.38
C2

covid1987.ddns.net:9090

Attributes
communication_password
b4df9f494056d51f86c7f1a89850c467
tor_process
tor
Signatures 8

Filter: none

  • BitRAT

    Description

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    Description

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    Tags

  • Downloads MZ/PE file
  • Suspicious use of NtSetInformationThreadHideFromDebugger
    RegAsm.exe

    Reported IOCs

    pidprocess
    2160RegAsm.exe
    2160RegAsm.exe
    2160RegAsm.exe
    2160RegAsm.exe
    2160RegAsm.exe
  • Suspicious use of SetThreadContext
    Document.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1572 set thread context of 21601572Document.exeRegAsm.exe
  • Suspicious use of AdjustPrivilegeToken
    Document.exeRegAsm.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1572Document.exe
    Token: SeShutdownPrivilege2160RegAsm.exe
  • Suspicious use of SetWindowsHookEx
    RegAsm.exe

    Reported IOCs

    pidprocess
    2160RegAsm.exe
    2160RegAsm.exe
  • Suspicious use of WriteProcessMemory
    Document.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1572 wrote to memory of 21601572Document.exeRegAsm.exe
    PID 1572 wrote to memory of 21601572Document.exeRegAsm.exe
    PID 1572 wrote to memory of 21601572Document.exeRegAsm.exe
    PID 1572 wrote to memory of 21601572Document.exeRegAsm.exe
    PID 1572 wrote to memory of 21601572Document.exeRegAsm.exe
    PID 1572 wrote to memory of 21601572Document.exeRegAsm.exe
    PID 1572 wrote to memory of 21601572Document.exeRegAsm.exe
    PID 1572 wrote to memory of 21601572Document.exeRegAsm.exe
    PID 1572 wrote to memory of 21601572Document.exeRegAsm.exe
    PID 1572 wrote to memory of 21601572Document.exeRegAsm.exe
    PID 1572 wrote to memory of 21601572Document.exeRegAsm.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\Document.exe
    "C:\Users\Admin\AppData\Local\Temp\Document.exe"
    Suspicious use of SetThreadContext
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1572
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2160
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/1572-115-0x0000000000D80000-0x0000000000DF4000-memory.dmp

                          • memory/1572-116-0x0000000000D80000-0x0000000000DF4000-memory.dmp

                          • memory/1572-117-0x0000000005D10000-0x000000000620E000-memory.dmp

                          • memory/1572-118-0x00000000056B0000-0x0000000005742000-memory.dmp

                          • memory/1572-119-0x0000000005620000-0x000000000562A000-memory.dmp

                          • memory/1572-120-0x0000000005810000-0x0000000005D0E000-memory.dmp

                          • memory/1572-121-0x0000000005810000-0x0000000005D0E000-memory.dmp

                          • memory/1572-122-0x0000000007F90000-0x0000000007FB6000-memory.dmp

                          • memory/2160-124-0x000000000068A488-mapping.dmp

                          • memory/2160-123-0x0000000000400000-0x00000000007CE000-memory.dmp

                          • memory/2160-125-0x0000000000400000-0x00000000007CE000-memory.dmp

                          • memory/2160-126-0x0000000000400000-0x00000000007CE000-memory.dmp