Analysis

  • max time kernel
    163s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    08/05/2022, 07:30

General

  • Target

    f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe

  • Size

    2.1MB

  • MD5

    e42e185f70b5c89af184424bb35da929

  • SHA1

    2023e739f67dca9aadfa3143678444b53d9711ed

  • SHA256

    f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e

  • SHA512

    c6f171100ce8411246db5f49e7b7ace7780eefd6cce5490bb570f45d3abc928ae45d78f0d26d90e211612fe67f37942010a9ccd21d53efec8b77b13f9c534430

Malware Config

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • BitRAT Payload 2 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Turns off Windows Defender SpyNet reporting 2 TTPs
  • Windows security bypass 2 TTPs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Windows security modification 2 TTPs 11 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 33 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe
    "C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Drops startup file
    • Windows security modification
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4180
    • C:\Windows\SysWOW64\timeout.exe
      timeout 4
      2⤵
      • Delays execution with timeout.exe
      PID:3084
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4344
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3516
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2116
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2088
    • C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe
      "C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe"
      2⤵
        PID:4560
      • C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe
        "C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe"
        2⤵
          PID:4748
        • C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe
          "C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe"
          2⤵
            PID:2756
          • C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe
            "C:\Users\Admin\AppData\Local\Temp\f993f006b0712bbfd2fa2ea4d0d56acc1c28563ff6146101406562fe1e2bb97e.exe"
            2⤵
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2032
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 1580
            2⤵
            • Program crash
            PID:1536
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4180 -ip 4180
          1⤵
            PID:2076

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                  Filesize

                  2KB

                  MD5

                  968cb9309758126772781b83adb8a28f

                  SHA1

                  8da30e71accf186b2ba11da1797cf67f8f78b47c

                  SHA256

                  92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                  SHA512

                  4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  18KB

                  MD5

                  4a38d5b0b02b758b2880578f7b5f9f7b

                  SHA1

                  08219944009c483e3674240ebe75555c6d0f6e8c

                  SHA256

                  b211519273748838dcc66e92727385a9f91c270987e014348511fd28f61669d9

                  SHA512

                  8218cbe01f72ac490264fbf6ec030450f6b20c88e7eb3d0d3f27333bbd04059d4962393d20a76a9b1324c57dd21ca427c632010c83804a6844b09e9082de72a9

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  18KB

                  MD5

                  d51ca9e06574c673490e81c52ff7a38f

                  SHA1

                  43bb7f11f917ca94c75f785fd8abfc078c7d795b

                  SHA256

                  287f0cd71a4dcde2cd52bb3629f2f1ef6203cfd04929d2f5694486b1e435b471

                  SHA512

                  a260768d2078fbd648e2c4faa18a66a020ee33d5e3f2d28e5b66d954c61d3dded6b05ff9c91bb40f7a2f739a2d626638d98b3c00caa7bb2475138f3e20790868

                • memory/2032-150-0x0000000000400000-0x000000000081E000-memory.dmp

                  Filesize

                  4.1MB

                • memory/2032-149-0x0000000000400000-0x000000000081E000-memory.dmp

                  Filesize

                  4.1MB

                • memory/2032-154-0x0000000000400000-0x000000000081E000-memory.dmp

                  Filesize

                  4.1MB

                • memory/2032-160-0x0000000000400000-0x000000000081E000-memory.dmp

                  Filesize

                  4.1MB

                • memory/2032-148-0x0000000000400000-0x000000000081E000-memory.dmp

                  Filesize

                  4.1MB

                • memory/2088-163-0x0000000007540000-0x000000000754E000-memory.dmp

                  Filesize

                  56KB

                • memory/2088-165-0x0000000007630000-0x0000000007638000-memory.dmp

                  Filesize

                  32KB

                • memory/2088-157-0x000000006F4F0000-0x000000006F53C000-memory.dmp

                  Filesize

                  304KB

                • memory/2116-151-0x00000000065E0000-0x0000000006612000-memory.dmp

                  Filesize

                  200KB

                • memory/2116-162-0x00000000075B0000-0x0000000007646000-memory.dmp

                  Filesize

                  600KB

                • memory/2116-155-0x000000006F4F0000-0x000000006F53C000-memory.dmp

                  Filesize

                  304KB

                • memory/3516-158-0x0000000007B60000-0x00000000081DA000-memory.dmp

                  Filesize

                  6.5MB

                • memory/3516-153-0x000000006F4F0000-0x000000006F53C000-memory.dmp

                  Filesize

                  304KB

                • memory/3516-141-0x0000000005340000-0x00000000053A6000-memory.dmp

                  Filesize

                  408KB

                • memory/3516-159-0x0000000007510000-0x000000000752A000-memory.dmp

                  Filesize

                  104KB

                • memory/4180-130-0x0000000000370000-0x000000000058A000-memory.dmp

                  Filesize

                  2.1MB

                • memory/4180-131-0x0000000004EE0000-0x0000000004F7C000-memory.dmp

                  Filesize

                  624KB

                • memory/4180-133-0x0000000005A90000-0x0000000006034000-memory.dmp

                  Filesize

                  5.6MB

                • memory/4344-142-0x0000000005520000-0x0000000005586000-memory.dmp

                  Filesize

                  408KB

                • memory/4344-152-0x000000006F4F0000-0x000000006F53C000-memory.dmp

                  Filesize

                  304KB

                • memory/4344-156-0x0000000006130000-0x000000000614E000-memory.dmp

                  Filesize

                  120KB

                • memory/4344-161-0x0000000005FA0000-0x0000000005FAA000-memory.dmp

                  Filesize

                  40KB

                • memory/4344-164-0x00000000071F0000-0x000000000720A000-memory.dmp

                  Filesize

                  104KB

                • memory/4344-143-0x0000000005B90000-0x0000000005BAE000-memory.dmp

                  Filesize

                  120KB

                • memory/4344-140-0x0000000004BE0000-0x0000000004C02000-memory.dmp

                  Filesize

                  136KB

                • memory/4344-139-0x0000000004E80000-0x00000000054A8000-memory.dmp

                  Filesize

                  6.2MB

                • memory/4344-136-0x00000000022B0000-0x00000000022E6000-memory.dmp

                  Filesize

                  216KB