Analysis

  • max time kernel
    151s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    20-01-2022 19:00

General

  • Target

    8f161c203384b95bc5b20e122a9c1c68.exe

  • Size

    323KB

  • MD5

    8f161c203384b95bc5b20e122a9c1c68

  • SHA1

    c72b4a03fef8c75ff0aab7bd97722249c9334ab0

  • SHA256

    4ea881ce90cbf4c9f6f26b940e062bbd147531c6754390f7e61784d892b54668

  • SHA512

    5b057a81759833c140153d4154f03ec6f0d544411f6739310b0c9f271b77d613c50062076a9aec951a527fed3aa55cc9d2fdd2a9bdd337912e020cd986066587

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

utfghjhkyut.duckdns.org:1882

Attributes
  • communication_password

    81dc9bdb52d04dc20036dbd8313ed055

  • install_dir

    AppData

  • install_file

    chrome.exe

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f161c203384b95bc5b20e122a9c1c68.exe
    "C:\Users\Admin\AppData\Local\Temp\8f161c203384b95bc5b20e122a9c1c68.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1564
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc cABpAG4AZwAgAHkAYQBoAG8AbwAuAGMAbwBtADsAIABwAGkAbgBnACAAeQBhAGgAbwBvAC4AYwBvAG0AOwBwAGkAbgBnACAAeQBhAGgAbwBvAC4AYwBvAG0AOwBwAGkAbgBnACAAeQBhAGgAbwBvAC4AYwBvAG0AOwBwAGkAbgBnACAAeQBhAGgAbwBvAC4AYwBvAG0AOwA=
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:436
      • C:\Windows\SysWOW64\PING.EXE
        "C:\Windows\system32\PING.EXE" yahoo.com
        3⤵
        • Runs ping.exe
        PID:1056
      • C:\Windows\SysWOW64\PING.EXE
        "C:\Windows\system32\PING.EXE" yahoo.com
        3⤵
        • Runs ping.exe
        PID:1944
      • C:\Windows\SysWOW64\PING.EXE
        "C:\Windows\system32\PING.EXE" yahoo.com
        3⤵
        • Runs ping.exe
        PID:364
      • C:\Windows\SysWOW64\PING.EXE
        "C:\Windows\system32\PING.EXE" yahoo.com
        3⤵
        • Runs ping.exe
        PID:2024
      • C:\Windows\SysWOW64\PING.EXE
        "C:\Windows\system32\PING.EXE" yahoo.com
        3⤵
        • Runs ping.exe
        PID:1408
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      2⤵
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1496

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/436-59-0x00000000023C0000-0x000000000300A000-memory.dmp
    Filesize

    12MB

  • memory/436-60-0x00000000023C0000-0x000000000300A000-memory.dmp
    Filesize

    12MB

  • memory/436-58-0x00000000023C0000-0x000000000300A000-memory.dmp
    Filesize

    12MB

  • memory/1496-68-0x0000000000400000-0x00000000007E4000-memory.dmp
    Filesize

    3MB

  • memory/1496-65-0x0000000000400000-0x00000000007E4000-memory.dmp
    Filesize

    3MB

  • memory/1496-66-0x0000000000400000-0x00000000007E4000-memory.dmp
    Filesize

    3MB

  • memory/1496-67-0x0000000000400000-0x00000000007E4000-memory.dmp
    Filesize

    3MB

  • memory/1496-70-0x0000000000400000-0x00000000007E4000-memory.dmp
    Filesize

    3MB

  • memory/1496-71-0x0000000000400000-0x00000000007E4000-memory.dmp
    Filesize

    3MB

  • memory/1496-72-0x0000000000401000-0x00000000007E4000-memory.dmp
    Filesize

    3MB

  • memory/1564-56-0x00000000756C1000-0x00000000756C3000-memory.dmp
    Filesize

    8KB

  • memory/1564-61-0x00000000049A0000-0x00000000049A1000-memory.dmp
    Filesize

    4KB

  • memory/1564-62-0x0000000005A50000-0x0000000005BFE000-memory.dmp
    Filesize

    1MB

  • memory/1564-63-0x00000000060B0000-0x0000000006246000-memory.dmp
    Filesize

    1MB

  • memory/1564-64-0x0000000004A50000-0x0000000004A9C000-memory.dmp
    Filesize

    304KB

  • memory/1564-55-0x00000000000E0000-0x0000000000138000-memory.dmp
    Filesize

    352KB