Analysis

  • max time kernel
    170s
  • max time network
    198s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    08/05/2022, 07:30

General

  • Target

    f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe

  • Size

    2.1MB

  • MD5

    e42e185f70b5c89af184424bb35da929

  • SHA1

    2023e739f67dca9aadfa3143678444b53d9711ed

  • SHA256

    f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e

  • SHA512

    c6f171100ce8411246db5f49e7b7ace7780eefd6cce5490bb570f45d3abc928ae45d78f0d26d90e211612fe67f37942010a9ccd21d53efec8b77b13f9c534430

Malware Config

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • BitRAT Payload 3 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Windows security bypass 2 TTPs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops startup file 2 IoCs
  • Windows security modification 2 TTPs 9 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe
    "C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Windows security modification
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\SysWOW64\timeout.exe
      timeout 4
      2⤵
      • Delays execution with timeout.exe
      PID:1744
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1288
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1096
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1480
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:872
    • C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe
      "C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1668
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 1352
      2⤵
      • Program crash
      PID:980

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

          Filesize

          7KB

          MD5

          c0fb8fdae68d5c81d305b649333a84e5

          SHA1

          e7a77ef57e1d8ec42f4bcc48436d08f4dcfaa85e

          SHA256

          0dacd23f0a9494d130852841b7ed8cdd0b8b3a33f8f52f695db807bbe5e876f7

          SHA512

          05878de9298ff97fed97a9d394cbb5f53576518461249a50c48f24d6615d0c3a9c7668d132e4d7a1433be9534d47e6503acac0eb32e003a77c06430280b023ef

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

          Filesize

          7KB

          MD5

          c0fb8fdae68d5c81d305b649333a84e5

          SHA1

          e7a77ef57e1d8ec42f4bcc48436d08f4dcfaa85e

          SHA256

          0dacd23f0a9494d130852841b7ed8cdd0b8b3a33f8f52f695db807bbe5e876f7

          SHA512

          05878de9298ff97fed97a9d394cbb5f53576518461249a50c48f24d6615d0c3a9c7668d132e4d7a1433be9534d47e6503acac0eb32e003a77c06430280b023ef

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

          Filesize

          7KB

          MD5

          c0fb8fdae68d5c81d305b649333a84e5

          SHA1

          e7a77ef57e1d8ec42f4bcc48436d08f4dcfaa85e

          SHA256

          0dacd23f0a9494d130852841b7ed8cdd0b8b3a33f8f52f695db807bbe5e876f7

          SHA512

          05878de9298ff97fed97a9d394cbb5f53576518461249a50c48f24d6615d0c3a9c7668d132e4d7a1433be9534d47e6503acac0eb32e003a77c06430280b023ef

        • memory/872-72-0x000000006FCC0000-0x000000007026B000-memory.dmp

          Filesize

          5.7MB

        • memory/1096-70-0x000000006FCC0000-0x000000007026B000-memory.dmp

          Filesize

          5.7MB

        • memory/1288-69-0x000000006FCC0000-0x000000007026B000-memory.dmp

          Filesize

          5.7MB

        • memory/1480-71-0x000000006FCC0000-0x000000007026B000-memory.dmp

          Filesize

          5.7MB

        • memory/1668-73-0x0000000000400000-0x000000000081E000-memory.dmp

          Filesize

          4.1MB

        • memory/1668-79-0x0000000000400000-0x000000000081E000-memory.dmp

          Filesize

          4.1MB

        • memory/1668-86-0x0000000000400000-0x000000000081E000-memory.dmp

          Filesize

          4.1MB

        • memory/1668-83-0x0000000000400000-0x000000000081E000-memory.dmp

          Filesize

          4.1MB

        • memory/1668-74-0x0000000000400000-0x000000000081E000-memory.dmp

          Filesize

          4.1MB

        • memory/1668-76-0x0000000000400000-0x000000000081E000-memory.dmp

          Filesize

          4.1MB

        • memory/1668-77-0x0000000000400000-0x000000000081E000-memory.dmp

          Filesize

          4.1MB

        • memory/1668-82-0x0000000000400000-0x000000000081E000-memory.dmp

          Filesize

          4.1MB

        • memory/1668-81-0x0000000000400000-0x000000000081E000-memory.dmp

          Filesize

          4.1MB

        • memory/2024-54-0x000000000F8C0000-0x000000000FADA000-memory.dmp

          Filesize

          2.1MB

        • memory/2024-57-0x0000000004DB0000-0x0000000004F9C000-memory.dmp

          Filesize

          1.9MB

        • memory/2024-55-0x00000000765F1000-0x00000000765F3000-memory.dmp

          Filesize

          8KB