Overview

overview

10

Static

static

RFQ-PO821606.xlsx

windows7_x64

10

RFQ-PO821606.xlsx

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RFQ-PO821606.xlsx

  • Size

    1.5MB

  • Sample

    220617-hfrqhsdch4

  • MD5

    e913764056bbcb4f8e3783aa660fa2e3

  • SHA1

    d011075e2ba6249087aab85d9278967a120ae0d3

  • SHA256

    97127c14c6267779a3ccde27dd5253645ad4a502095fa4c0f9156f32f13388ac

  • SHA512

    d689cfeee3c305da33b9cca11ef17127294bee6df696ebbcbb3943881a5bd67f0f3f88e128ddcbbbd829b6558042ba7c8c848f644f9633d7680793f3edd4748d

Score
10/10
bitratpersistencesuricatatrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

stonecold.ddns.net:4812

Attributes
  • communication_password

    ac7b2a72c82f15c4898d6a8f05cab46b

  • tor_process

    tor

Targets

    • Target

      RFQ-PO821606.xlsx

    • Size

      1.5MB

    • MD5

      e913764056bbcb4f8e3783aa660fa2e3

    • SHA1

      d011075e2ba6249087aab85d9278967a120ae0d3

    • SHA256

      97127c14c6267779a3ccde27dd5253645ad4a502095fa4c0f9156f32f13388ac

    • SHA512

      d689cfeee3c305da33b9cca11ef17127294bee6df696ebbcbb3943881a5bd67f0f3f88e128ddcbbbd829b6558042ba7c8c848f644f9633d7680793f3edd4748d

    Score
    10/10
    bitratpersistencesuricatatrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

      suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

      suricata

    • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

      suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

      suricata

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks