Analysis

  • max time kernel
    303s
  • max time network
    306s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    09/05/2022, 19:12

General

  • Target

    Invoice May 2 to 6 2022.exe

  • Size

    300.0MB

  • MD5

    9ee044706961afb5c1b1cc98936786b5

  • SHA1

    b583dd8cb884cc786ae6ccb5c007537f42ca20d0

  • SHA256

    9fd0b4d7a63cd7cd3574b4f6a766f99f6c3ec1d1a9f83627e5c10a811f289657

  • SHA512

    255752dd32861a2935509cd54d9ee78e59340ae292216d91243593682b5b876bfe3c157d4396dc4a692d067fe90f4260acc4431baeed06dab1ce4739fcaccb03

Score
10/10

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

houseofc.duckdns.org:24993

Attributes
  • communication_password

    d6723e7cd6735df68d1ce4c704c29a04

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Executes dropped EXE 5 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Invoice May 2 to 6 2022.exe
    "C:\Users\Admin\AppData\Local\Temp\Invoice May 2 to 6 2022.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4876
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\laoqp.exe'" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\laoqp.exe'" /f
        3⤵
        • Creates scheduled task(s)
        PID:3476
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\Invoice May 2 to 6 2022.exe" "C:\Users\Admin\AppData\Roaming\laoqp.exe"
      2⤵
        PID:1760
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1136
    • C:\Users\Admin\AppData\Roaming\laoqp.exe
      C:\Users\Admin\AppData\Roaming\laoqp.exe
      1⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4072
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\laoqp.exe'" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:308
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\laoqp.exe'" /f
          3⤵
          • Creates scheduled task(s)
          PID:4388
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\laoqp.exe" "C:\Users\Admin\AppData\Roaming\laoqp.exe"
        2⤵
          PID:1564
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of AdjustPrivilegeToken
          PID:1616
      • C:\Users\Admin\AppData\Roaming\laoqp.exe
        C:\Users\Admin\AppData\Roaming\laoqp.exe
        1⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4800
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\laoqp.exe'" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:476
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\laoqp.exe'" /f
            3⤵
            • Creates scheduled task(s)
            PID:3792
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\laoqp.exe" "C:\Users\Admin\AppData\Roaming\laoqp.exe"
          2⤵
            PID:3140
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            2⤵
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of AdjustPrivilegeToken
            PID:3636
        • C:\Users\Admin\AppData\Roaming\laoqp.exe
          C:\Users\Admin\AppData\Roaming\laoqp.exe
          1⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2652
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\laoqp.exe'" /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1948
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\laoqp.exe'" /f
              3⤵
              • Creates scheduled task(s)
              PID:2260
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\laoqp.exe" "C:\Users\Admin\AppData\Roaming\laoqp.exe"
            2⤵
              PID:4244
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              2⤵
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of AdjustPrivilegeToken
              PID:1464
          • C:\Users\Admin\AppData\Roaming\laoqp.exe
            C:\Users\Admin\AppData\Roaming\laoqp.exe
            1⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Suspicious use of SetThreadContext
            PID:2700
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\laoqp.exe'" /f
              2⤵
                PID:4860
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\laoqp.exe'" /f
                  3⤵
                  • Creates scheduled task(s)
                  PID:4908
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\laoqp.exe" "C:\Users\Admin\AppData\Roaming\laoqp.exe"
                2⤵
                  PID:4416
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  2⤵
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4248
              • C:\Users\Admin\AppData\Roaming\laoqp.exe
                C:\Users\Admin\AppData\Roaming\laoqp.exe
                1⤵
                • Executes dropped EXE
                PID:1504

              Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\laoqp.exe.log

                      Filesize

                      805B

                      MD5

                      4b74e933d78bd5e8fb1cc4653fb2133c

                      SHA1

                      f6e931eec700fa325bd40c3adc6f1c0eba806066

                      SHA256

                      fd99bed17853f5ad196ca6d4a62f5e2405fbdf5b98cbf45af8b7cef83e4bcec3

                      SHA512

                      b56ff89eff1a757a87dcb875206ae92d39ffdb5adf638600c21bc7c76ff4cc25502ae1060716488c7ed1641f8cdfad2a320443b7b4d9f09808eb86eb87f351ec

                    • C:\Users\Admin\AppData\Roaming\laoqp.exe

                      Filesize

                      300.0MB

                      MD5

                      9ee044706961afb5c1b1cc98936786b5

                      SHA1

                      b583dd8cb884cc786ae6ccb5c007537f42ca20d0

                      SHA256

                      9fd0b4d7a63cd7cd3574b4f6a766f99f6c3ec1d1a9f83627e5c10a811f289657

                      SHA512

                      255752dd32861a2935509cd54d9ee78e59340ae292216d91243593682b5b876bfe3c157d4396dc4a692d067fe90f4260acc4431baeed06dab1ce4739fcaccb03

                    • C:\Users\Admin\AppData\Roaming\laoqp.exe

                      Filesize

                      300.0MB

                      MD5

                      9ee044706961afb5c1b1cc98936786b5

                      SHA1

                      b583dd8cb884cc786ae6ccb5c007537f42ca20d0

                      SHA256

                      9fd0b4d7a63cd7cd3574b4f6a766f99f6c3ec1d1a9f83627e5c10a811f289657

                      SHA512

                      255752dd32861a2935509cd54d9ee78e59340ae292216d91243593682b5b876bfe3c157d4396dc4a692d067fe90f4260acc4431baeed06dab1ce4739fcaccb03

                    • C:\Users\Admin\AppData\Roaming\laoqp.exe

                      Filesize

                      300.0MB

                      MD5

                      9ee044706961afb5c1b1cc98936786b5

                      SHA1

                      b583dd8cb884cc786ae6ccb5c007537f42ca20d0

                      SHA256

                      9fd0b4d7a63cd7cd3574b4f6a766f99f6c3ec1d1a9f83627e5c10a811f289657

                      SHA512

                      255752dd32861a2935509cd54d9ee78e59340ae292216d91243593682b5b876bfe3c157d4396dc4a692d067fe90f4260acc4431baeed06dab1ce4739fcaccb03

                    • C:\Users\Admin\AppData\Roaming\laoqp.exe

                      Filesize

                      300.0MB

                      MD5

                      9ee044706961afb5c1b1cc98936786b5

                      SHA1

                      b583dd8cb884cc786ae6ccb5c007537f42ca20d0

                      SHA256

                      9fd0b4d7a63cd7cd3574b4f6a766f99f6c3ec1d1a9f83627e5c10a811f289657

                      SHA512

                      255752dd32861a2935509cd54d9ee78e59340ae292216d91243593682b5b876bfe3c157d4396dc4a692d067fe90f4260acc4431baeed06dab1ce4739fcaccb03

                    • C:\Users\Admin\AppData\Roaming\laoqp.exe

                      Filesize

                      300.0MB

                      MD5

                      9ee044706961afb5c1b1cc98936786b5

                      SHA1

                      b583dd8cb884cc786ae6ccb5c007537f42ca20d0

                      SHA256

                      9fd0b4d7a63cd7cd3574b4f6a766f99f6c3ec1d1a9f83627e5c10a811f289657

                      SHA512

                      255752dd32861a2935509cd54d9ee78e59340ae292216d91243593682b5b876bfe3c157d4396dc4a692d067fe90f4260acc4431baeed06dab1ce4739fcaccb03

                    • C:\Users\Admin\AppData\Roaming\laoqp.exe

                      Filesize

                      229.8MB

                      MD5

                      07bc8e0b433be8b1311525d476634ca7

                      SHA1

                      c171b45dae9cc9719969eb2ce75244fbb37235cb

                      SHA256

                      fc5a4d868f6932e104c385ef5d9d7a094bf3526a0e3e54265d37d0a1f8084323

                      SHA512

                      b3ad1d10a4956ac85fca9792b9d765a7f0308b86f8c7f021e4d255b687a4c16a1e4b02cc0a679f790e40ab121609851b30a11b3a755a8b8920f8383ae6c65de4

                    • memory/1136-138-0x0000000000400000-0x00000000007E4000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/1136-140-0x0000000000400000-0x00000000007E4000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/1136-141-0x0000000000400000-0x00000000007E4000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/1136-139-0x0000000000400000-0x00000000007E4000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/1136-137-0x0000000000400000-0x00000000007E4000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/1464-173-0x0000000000400000-0x00000000007E4000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/1616-152-0x0000000000400000-0x00000000007E4000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/3636-163-0x0000000000400000-0x00000000007E4000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/4248-183-0x0000000000400000-0x00000000007E4000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/4876-130-0x0000000000A50000-0x0000000000C16000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/4876-132-0x00000000055F0000-0x0000000005682000-memory.dmp

                      Filesize

                      584KB

                    • memory/4876-131-0x0000000005B00000-0x00000000060A4000-memory.dmp

                      Filesize

                      5.6MB