Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    10/05/2022, 22:35

General

  • Target

    f0fd5d38ffa54d8dfd6456c0b7a8664b.exe

  • Size

    4.6MB

  • MD5

    f0fd5d38ffa54d8dfd6456c0b7a8664b

  • SHA1

    36387a6cd5c900fb78e6fc67a88e84a472d05b61

  • SHA256

    4e3056448e294407b47e08e4dd3364b14acc1fe05d602cbe3347e10800f925ae

  • SHA512

    80b57e0e8feb4241631adfd73678ea8c4094397c4053855bfd3cce2d4762be8c67da46fe3e41b73766596723d370692cb31a75ba2bf475b40f2c4f2c1a9eb7db

Score
10/10

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

https.myvnc.com:9111

Attributes
  • communication_password

    c4ca4238a0b923820dcc509a6f75849b

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0fd5d38ffa54d8dfd6456c0b7a8664b.exe
    "C:\Users\Admin\AppData\Local\Temp\f0fd5d38ffa54d8dfd6456c0b7a8664b.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3356
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f0fd5d38ffa54d8dfd6456c0b7a8664b.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3260
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rGucnaAeGqFkx.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2660
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rGucnaAeGqFkx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp248F.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2508
    • C:\Users\Admin\AppData\Local\Temp\f0fd5d38ffa54d8dfd6456c0b7a8664b.exe
      "C:\Users\Admin\AppData\Local\Temp\f0fd5d38ffa54d8dfd6456c0b7a8664b.exe"
      2⤵
        PID:4196
      • C:\Users\Admin\AppData\Local\Temp\f0fd5d38ffa54d8dfd6456c0b7a8664b.exe
        "C:\Users\Admin\AppData\Local\Temp\f0fd5d38ffa54d8dfd6456c0b7a8664b.exe"
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4304

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            968cb9309758126772781b83adb8a28f

            SHA1

            8da30e71accf186b2ba11da1797cf67f8f78b47c

            SHA256

            92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

            SHA512

            4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            609B

            MD5

            04bebfdd3dd2a37f8a6c4b866531a336

            SHA1

            b974edb0ddedac47aad59dfb284933ce4941390b

            SHA256

            1b61025d347152bbfba6cfd465f1121843ca6953627eafb5c6dc22f5b22fb667

            SHA512

            17d7a787ae4e38bb0e7bc8c49c0331ba3ff30d53ddc7eade292e939dd17f79b4f7476bbd08866bc91674b649bf909034a1efa4a3d5ee2cedb5683bccf274bd1f

          • C:\Users\Admin\AppData\Local\Temp\tmp248F.tmp

            Filesize

            1KB

            MD5

            4b13bd67cade98501400c62a2f4eb0e3

            SHA1

            6504f657347472c185eaad89af67857856e2f7e8

            SHA256

            396029ad083faeb4cc90b75044e16427303beb75987e116a2c7311d9e088e90c

            SHA512

            c5d43312407966404eb7f6d8f11c8e43b393bb002dbc2c6270ce2e70cc95776a87e137a573febdc1a77e28e0f45e8bfa5c02865a1938b480d1357be59ae8f7ec

          • memory/2660-161-0x0000000007EC0000-0x0000000007EC8000-memory.dmp

            Filesize

            32KB

          • memory/2660-159-0x0000000007DD0000-0x0000000007DDE000-memory.dmp

            Filesize

            56KB

          • memory/2660-158-0x0000000007E20000-0x0000000007EB6000-memory.dmp

            Filesize

            600KB

          • memory/2660-151-0x0000000006E10000-0x0000000006E42000-memory.dmp

            Filesize

            200KB

          • memory/2660-153-0x000000006FF30000-0x000000006FF7C000-memory.dmp

            Filesize

            304KB

          • memory/2660-143-0x0000000005B70000-0x0000000005BD6000-memory.dmp

            Filesize

            408KB

          • memory/3260-154-0x0000000006C60000-0x0000000006C7E000-memory.dmp

            Filesize

            120KB

          • memory/3260-157-0x0000000006E30000-0x0000000006E3A000-memory.dmp

            Filesize

            40KB

          • memory/3260-140-0x0000000004DA0000-0x00000000053C8000-memory.dmp

            Filesize

            6.2MB

          • memory/3260-144-0x0000000005AB0000-0x0000000005ACE000-memory.dmp

            Filesize

            120KB

          • memory/3260-162-0x00000000070E0000-0x00000000070E8000-memory.dmp

            Filesize

            32KB

          • memory/3260-160-0x0000000007100000-0x000000000711A000-memory.dmp

            Filesize

            104KB

          • memory/3260-141-0x0000000004CE0000-0x0000000004D02000-memory.dmp

            Filesize

            136KB

          • memory/3260-156-0x0000000006DC0000-0x0000000006DDA000-memory.dmp

            Filesize

            104KB

          • memory/3260-155-0x0000000007400000-0x0000000007A7A000-memory.dmp

            Filesize

            6.5MB

          • memory/3260-152-0x000000006FF30000-0x000000006FF7C000-memory.dmp

            Filesize

            304KB

          • memory/3260-138-0x00000000021C0000-0x00000000021F6000-memory.dmp

            Filesize

            216KB

          • memory/3356-130-0x0000000000D60000-0x00000000011F4000-memory.dmp

            Filesize

            4.6MB

          • memory/3356-135-0x000000000BD20000-0x000000000BD86000-memory.dmp

            Filesize

            408KB

          • memory/3356-134-0x0000000009520000-0x00000000095BC000-memory.dmp

            Filesize

            624KB

          • memory/3356-133-0x0000000005BC0000-0x0000000005BCA000-memory.dmp

            Filesize

            40KB

          • memory/3356-132-0x0000000005BF0000-0x0000000005C82000-memory.dmp

            Filesize

            584KB

          • memory/3356-131-0x0000000006100000-0x00000000066A4000-memory.dmp

            Filesize

            5.6MB

          • memory/4304-150-0x0000000000400000-0x00000000007CE000-memory.dmp

            Filesize

            3.8MB

          • memory/4304-149-0x0000000000400000-0x00000000007CE000-memory.dmp

            Filesize

            3.8MB

          • memory/4304-148-0x0000000000400000-0x00000000007CE000-memory.dmp

            Filesize

            3.8MB

          • memory/4304-147-0x0000000000400000-0x00000000007CE000-memory.dmp

            Filesize

            3.8MB