Behavioral Report

Resubmissions

15-01-2022 17:03

220115-vks6cseha4 10

15-01-2022 17:02

220115-vj9fysfbgj 7

15-01-2022 16:58

220115-vg7jksegh8 7

Analysis

max time kernel
4265101s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
15-01-2022 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

063822ca7966327be6a3dadb06e16d6c.exe.vir.exe
Size

5MB
MD5

063822ca7966327be6a3dadb06e16d6c
SHA1

68f61f2bcf3c325adbb190b892297d78a4f75254
SHA256

515f555c06db60243a892bbdf57704792956569387482f6a7a001a782bb6bcd1
SHA512

8c6e0963f3d8c4510426e8cf7511e62cd65eb6873037e235f9b27ac52736f4535ccc1cf499e2c689285c4bc76a9e3cb276c6dc5144bf1bd1222714333e698be5

Score

10^/10

bitrat themida trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

2.56.59.239:7355

Attributes

communication_password
c7dd0cd2ba364f132afa1dc58698c64e
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

spoofer.exe

pid process

2876 spoofer.exe
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

behavioral2/memory/2772-132-0x00000000006D0000-0x0000000000FD6000-memory.dmp themida
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

063822ca7966327be6a3dadb06e16d6c.exe.vir.exespoofer.exe

pid process

2772 063822ca7966327be6a3dadb06e16d6c.exe.vir.exe
2876 spoofer.exe
2876 spoofer.exe
2876 spoofer.exe
2876 spoofer.exe
Drops file in Windows directory 1 IoCs

Processes:

063822ca7966327be6a3dadb06e16d6c.exe.vir.exe

description ioc process

File created C:\Windows\spoofer.exe 063822ca7966327be6a3dadb06e16d6c.exe.vir.exe

pid	process
2876	spoofer.exe

resource	yara_rule
behavioral2/memory/2772-132-0x00000000006D0000-0x0000000000FD6000-memory.dmp	themida

pid	process
2772	063822ca7966327be6a3dadb06e16d6c.exe.vir.exe
2876	spoofer.exe
2876	spoofer.exe
2876	spoofer.exe
2876	spoofer.exe

description	ioc	process
File created	C:\Windows\spoofer.exe	063822ca7966327be6a3dadb06e16d6c.exe.vir.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotification.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

063822ca7966327be6a3dadb06e16d6c.exe.vir.exe

pid process

2772 063822ca7966327be6a3dadb06e16d6c.exe.vir.exe
2772 063822ca7966327be6a3dadb06e16d6c.exe.vir.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

063822ca7966327be6a3dadb06e16d6c.exe.vir.exe

pid process

2772 063822ca7966327be6a3dadb06e16d6c.exe.vir.exe

pid	process
2772	063822ca7966327be6a3dadb06e16d6c.exe.vir.exe
2772	063822ca7966327be6a3dadb06e16d6c.exe.vir.exe

pid	process
2772	063822ca7966327be6a3dadb06e16d6c.exe.vir.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

MusNotification.exespoofer.exe

description	pid	process
Token: SeShutdownPrivilege	2204	MusNotification.exe
Token: SeCreatePagefilePrivilege	2204	MusNotification.exe
Token: SeShutdownPrivilege	2876	spoofer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

spoofer.exe

pid process

2876 spoofer.exe
2876 spoofer.exe

pid	process
2876	spoofer.exe
2876	spoofer.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

063822ca7966327be6a3dadb06e16d6c.exe.vir.execmd.exe

description	pid	process	target process
PID 2772 wrote to memory of 2160	2772	063822ca7966327be6a3dadb06e16d6c.exe.vir.exe	cmd.exe
PID 2772 wrote to memory of 2160	2772	063822ca7966327be6a3dadb06e16d6c.exe.vir.exe	cmd.exe
PID 2772 wrote to memory of 2160	2772	063822ca7966327be6a3dadb06e16d6c.exe.vir.exe	cmd.exe
PID 2160 wrote to memory of 2876	2160	cmd.exe	spoofer.exe
PID 2160 wrote to memory of 2876	2160	cmd.exe	spoofer.exe
PID 2160 wrote to memory of 2876	2160	cmd.exe	spoofer.exe

C:\Users\Admin\AppData\Local\Temp\063822ca7966327be6a3dadb06e16d6c.exe.vir.exe
"C:\Users\Admin\AppData\Local\Temp\063822ca7966327be6a3dadb06e16d6c.exe.vir.exe"
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C://Windows//spoofer.exe
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\spoofer.exe
C://Windows//spoofer.exe
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2876

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

00:00 00:00

Downloads

C:\Windows\spoofer.exe
MD5
647ca708578d150575f22990d4f59c80

SHA1
444acf34db6264ac9612ae2a3c20546482f64070

SHA256
7bb79061b7e9fe2e1149f524b99757604729d0195e56f737cf793c776b95a8aa

SHA512
8d34bb271069773427690ce3a2a11ed4a8a7cacc83823dc58b895a6bc1c7198ca0f6b1f7113452355ac5952539813754563ba6203576d4376f4ca3940fdd828d

Download Submit
C:\Windows\spoofer.exe
MD5
647ca708578d150575f22990d4f59c80

SHA1
444acf34db6264ac9612ae2a3c20546482f64070

SHA256
7bb79061b7e9fe2e1149f524b99757604729d0195e56f737cf793c776b95a8aa

SHA512
8d34bb271069773427690ce3a2a11ed4a8a7cacc83823dc58b895a6bc1c7198ca0f6b1f7113452355ac5952539813754563ba6203576d4376f4ca3940fdd828d

Download Submit
memory/2160-134-0x0000000000000000-mapping.dmp

Download
memory/2772-131-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/2772-132-0x00000000006D0000-0x0000000000FD6000-memory.dmp

Filesize
9MB

Download
memory/2772-133-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2876-135-0x0000000000000000-mapping.dmp

Download