Analysis

  • max time kernel
    143s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    08/05/2022, 06:13

General

  • Target

    d7c23da50a0ae8ebcdf3bc384e6498d09264bb051877e44840903f9039e45125.exe

  • Size

    4.2MB

  • MD5

    24389427385fcb96d62cacbcbc86249e

  • SHA1

    8f0e2ba854091afd15c846fb3d35cc3930633d67

  • SHA256

    d7c23da50a0ae8ebcdf3bc384e6498d09264bb051877e44840903f9039e45125

  • SHA512

    0fd000e30ca04f227f540d3e34e8985668c95ab5168681327c0e8c1b609b1831c9dbb26ddfcb044fe8dc675f69f2193b381a41b2736940c92dd2dc16b4bd1ede

Malware Config

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • BitRAT Payload 4 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Turns off Windows Defender SpyNet reporting 2 TTPs
  • Windows security bypass 2 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Windows security modification 2 TTPs 11 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7c23da50a0ae8ebcdf3bc384e6498d09264bb051877e44840903f9039e45125.exe
    "C:\Users\Admin\AppData\Local\Temp\d7c23da50a0ae8ebcdf3bc384e6498d09264bb051877e44840903f9039e45125.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Drops startup file
    • Windows security modification
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Windows\SysWOW64\timeout.exe
      timeout 4
      2⤵
      • Delays execution with timeout.exe
      PID:5060
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d7c23da50a0ae8ebcdf3bc384e6498d09264bb051877e44840903f9039e45125.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2728
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d7c23da50a0ae8ebcdf3bc384e6498d09264bb051877e44840903f9039e45125.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1348
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d7c23da50a0ae8ebcdf3bc384e6498d09264bb051877e44840903f9039e45125.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4404
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d7c23da50a0ae8ebcdf3bc384e6498d09264bb051877e44840903f9039e45125.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4000
    • C:\Users\Admin\AppData\Local\Temp\d7c23da50a0ae8ebcdf3bc384e6498d09264bb051877e44840903f9039e45125.exe
      "C:\Users\Admin\AppData\Local\Temp\d7c23da50a0ae8ebcdf3bc384e6498d09264bb051877e44840903f9039e45125.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      PID:900
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 2036
      2⤵
      • Program crash
      PID:1448
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 2036
      2⤵
      • Program crash
      PID:3164
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5068 -ip 5068
    1⤵
      PID:4552

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            3d086a433708053f9bf9523e1d87a4e8

            SHA1

            b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

            SHA256

            6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

            SHA512

            931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            3d086a433708053f9bf9523e1d87a4e8

            SHA1

            b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

            SHA256

            6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

            SHA512

            931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            18KB

            MD5

            ed25c55987b96515e185ba5be6bc0db6

            SHA1

            fd4a4ac80ecad033ca0f07cccf782e29c0474e4a

            SHA256

            120d186fc14d99fcdb074049a0f2ebcdd02720f14598bc3a03d8e24bbbebd8c1

            SHA512

            a0a671cbb42f597513cccff57cfe38e2d78ef5c8d7e85f1e087a776304a46727e86efec8ad5e3f487e778fdb479c8413fadfb80218c9455e87a3968cbe31a2b4

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            18KB

            MD5

            e0c5b1ab9d2fadf3525874b62e5efcb5

            SHA1

            74ab0f49febfa7a828844ae802232f2c862289d2

            SHA256

            f7a6fdceabe9aa6697f08ebed8c89e97f072512b8cc3a1a8445c058c3241c556

            SHA512

            89cadac46bbcb90ddef664535457f146092e88bb5329c00fed574bcbfa0c4cedd070b272cd372a01e7ab2cd0674b03ee43949377a0289e8658b24d9c66f0acb0

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            18KB

            MD5

            39f78f240ee7326700553ae5ce89683b

            SHA1

            988cff637774b2255d584b2fdc248a34bc5b04af

            SHA256

            d2003f5480c04de65fba62d583aa9687ade6048025aeb2fca92d8cb66c3a9f08

            SHA512

            4b7489132933af803338533929e01c9efd13cb6462bcc2608b1bf59f1912375db576ce2b578b43b081e4e41f3e8ba0808072bd77744e9c3082d082d239fe4e69

          • memory/900-166-0x0000000000400000-0x00000000007FF000-memory.dmp

            Filesize

            4.0MB

          • memory/900-165-0x0000000000400000-0x00000000007FF000-memory.dmp

            Filesize

            4.0MB

          • memory/900-164-0x0000000000400000-0x00000000007FF000-memory.dmp

            Filesize

            4.0MB

          • memory/900-163-0x0000000000400000-0x00000000007FF000-memory.dmp

            Filesize

            4.0MB

          • memory/1348-139-0x00000000059C0000-0x0000000005FE8000-memory.dmp

            Filesize

            6.2MB

          • memory/1348-147-0x0000000070370000-0x00000000703BC000-memory.dmp

            Filesize

            304KB

          • memory/1348-141-0x0000000005730000-0x0000000005796000-memory.dmp

            Filesize

            408KB

          • memory/1348-143-0x0000000006680000-0x000000000669E000-memory.dmp

            Filesize

            120KB

          • memory/2728-153-0x0000000007E20000-0x0000000007EB6000-memory.dmp

            Filesize

            600KB

          • memory/2728-142-0x0000000006130000-0x0000000006196000-memory.dmp

            Filesize

            408KB

          • memory/2728-145-0x0000000070370000-0x00000000703BC000-memory.dmp

            Filesize

            304KB

          • memory/2728-138-0x0000000002F70000-0x0000000002FA6000-memory.dmp

            Filesize

            216KB

          • memory/2728-140-0x00000000057C0000-0x00000000057E2000-memory.dmp

            Filesize

            136KB

          • memory/4000-148-0x0000000070370000-0x00000000703BC000-memory.dmp

            Filesize

            304KB

          • memory/4000-151-0x0000000007830000-0x000000000784A000-memory.dmp

            Filesize

            104KB

          • memory/4000-155-0x0000000007B70000-0x0000000007B8A000-memory.dmp

            Filesize

            104KB

          • memory/4000-156-0x0000000007B50000-0x0000000007B58000-memory.dmp

            Filesize

            32KB

          • memory/4404-150-0x0000000007460000-0x0000000007ADA000-memory.dmp

            Filesize

            6.5MB

          • memory/4404-152-0x0000000006E90000-0x0000000006E9A000-memory.dmp

            Filesize

            40KB

          • memory/4404-154-0x0000000007050000-0x000000000705E000-memory.dmp

            Filesize

            56KB

          • memory/4404-149-0x00000000060C0000-0x00000000060DE000-memory.dmp

            Filesize

            120KB

          • memory/4404-146-0x0000000070370000-0x00000000703BC000-memory.dmp

            Filesize

            304KB

          • memory/4404-144-0x00000000060E0000-0x0000000006112000-memory.dmp

            Filesize

            200KB

          • memory/5068-130-0x0000000000880000-0x0000000000CC0000-memory.dmp

            Filesize

            4.2MB

          • memory/5068-133-0x0000000006420000-0x00000000069C4000-memory.dmp

            Filesize

            5.6MB

          • memory/5068-131-0x00000000055F0000-0x000000000568C000-memory.dmp

            Filesize

            624KB