Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-06-2022 14:51

General

  • Target

    JO37GDDJF5_ETRANSFER_RECEIPT.exe

  • Size

    300.0MB

  • MD5

    9f791a0a9f76db609b44f0e3bf7bdef5

  • SHA1

    0481f2e178c7a34b3d855e5c53553337fe2008ed

  • SHA256

    ccd71d751bf017dee31f76eceded9aa6832f5e19b5389584d3665f76b4f0caf2

  • SHA512

    06889bebdf092e4f1563e697e9c619a147954ffcb1f9dd9e9a9238d1410442373f95558c02e6bae6f5d832f89a46eab8b08114699f7321ce2e1150a69f1ad1ee

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

bitrat9300.duckdns.org:9300

Attributes
  • communication_password

    e10adc3949ba59abbe56e057f20f883e

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

  • Executes dropped EXE 2 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JO37GDDJF5_ETRANSFER_RECEIPT.exe
    "C:\Users\Admin\AppData\Local\Temp\JO37GDDJF5_ETRANSFER_RECEIPT.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\nhbyg.exe'" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1324
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\nhbyg.exe'" /f
        3⤵
        • Creates scheduled task(s)
        PID:2044
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\JO37GDDJF5_ETRANSFER_RECEIPT.exe" "C:\Users\Admin\AppData\Roaming\nhbyg.exe"
      2⤵
        PID:2000
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1924
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {11E3AA29-65E9-4872-8E12-C2F5C8DB7D82} S-1-5-21-2277218442-1199762539-2004043321-1000:AUVQQRRF\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1616
      • C:\Users\Admin\AppData\Roaming\nhbyg.exe
        C:\Users\Admin\AppData\Roaming\nhbyg.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1316
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\nhbyg.exe'" /f
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1164
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\nhbyg.exe'" /f
            4⤵
            • Creates scheduled task(s)
            PID:1516
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\nhbyg.exe" "C:\Users\Admin\AppData\Roaming\nhbyg.exe"
          3⤵
            PID:576
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of AdjustPrivilegeToken
            PID:1632
        • C:\Users\Admin\AppData\Roaming\nhbyg.exe
          C:\Users\Admin\AppData\Roaming\nhbyg.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:920
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\nhbyg.exe'" /f
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1324
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\nhbyg.exe'" /f
              4⤵
              • Creates scheduled task(s)
              PID:1868
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\nhbyg.exe" "C:\Users\Admin\AppData\Roaming\nhbyg.exe"
            3⤵
              PID:1128
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of AdjustPrivilegeToken
              PID:880

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Execution

        Scheduled Task

        1
        T1053

        Persistence

        Scheduled Task

        1
        T1053

        Privilege Escalation

        Scheduled Task

        1
        T1053

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\nhbyg.exe
          Filesize

          300.0MB

          MD5

          9f791a0a9f76db609b44f0e3bf7bdef5

          SHA1

          0481f2e178c7a34b3d855e5c53553337fe2008ed

          SHA256

          ccd71d751bf017dee31f76eceded9aa6832f5e19b5389584d3665f76b4f0caf2

          SHA512

          06889bebdf092e4f1563e697e9c619a147954ffcb1f9dd9e9a9238d1410442373f95558c02e6bae6f5d832f89a46eab8b08114699f7321ce2e1150a69f1ad1ee

        • C:\Users\Admin\AppData\Roaming\nhbyg.exe
          Filesize

          300.0MB

          MD5

          9f791a0a9f76db609b44f0e3bf7bdef5

          SHA1

          0481f2e178c7a34b3d855e5c53553337fe2008ed

          SHA256

          ccd71d751bf017dee31f76eceded9aa6832f5e19b5389584d3665f76b4f0caf2

          SHA512

          06889bebdf092e4f1563e697e9c619a147954ffcb1f9dd9e9a9238d1410442373f95558c02e6bae6f5d832f89a46eab8b08114699f7321ce2e1150a69f1ad1ee

        • C:\Users\Admin\AppData\Roaming\nhbyg.exe
          Filesize

          300.0MB

          MD5

          9f791a0a9f76db609b44f0e3bf7bdef5

          SHA1

          0481f2e178c7a34b3d855e5c53553337fe2008ed

          SHA256

          ccd71d751bf017dee31f76eceded9aa6832f5e19b5389584d3665f76b4f0caf2

          SHA512

          06889bebdf092e4f1563e697e9c619a147954ffcb1f9dd9e9a9238d1410442373f95558c02e6bae6f5d832f89a46eab8b08114699f7321ce2e1150a69f1ad1ee

        • memory/576-85-0x0000000000000000-mapping.dmp
        • memory/880-120-0x0000000000400000-0x00000000007E4000-memory.dmp
          Filesize

          3.9MB

        • memory/880-119-0x0000000000400000-0x00000000007E4000-memory.dmp
          Filesize

          3.9MB

        • memory/880-112-0x00000000007E2730-mapping.dmp
        • memory/920-102-0x00000000000D0000-0x0000000000264000-memory.dmp
          Filesize

          1.6MB

        • memory/920-100-0x0000000000000000-mapping.dmp
        • memory/1048-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp
          Filesize

          8KB

        • memory/1048-54-0x0000000000240000-0x00000000003D4000-memory.dmp
          Filesize

          1.6MB

        • memory/1048-56-0x0000000004FB0000-0x0000000005126000-memory.dmp
          Filesize

          1.5MB

        • memory/1128-106-0x0000000000000000-mapping.dmp
        • memory/1164-83-0x0000000000000000-mapping.dmp
        • memory/1316-71-0x0000000000FF0000-0x0000000001184000-memory.dmp
          Filesize

          1.6MB

        • memory/1316-65-0x0000000000000000-mapping.dmp
        • memory/1324-104-0x0000000000000000-mapping.dmp
        • memory/1324-57-0x0000000000000000-mapping.dmp
        • memory/1516-84-0x0000000000000000-mapping.dmp
        • memory/1632-98-0x0000000000400000-0x00000000007E4000-memory.dmp
          Filesize

          3.9MB

        • memory/1632-97-0x0000000000400000-0x00000000007E4000-memory.dmp
          Filesize

          3.9MB

        • memory/1632-99-0x0000000000400000-0x00000000007E4000-memory.dmp
          Filesize

          3.9MB

        • memory/1632-96-0x0000000000400000-0x00000000007E4000-memory.dmp
          Filesize

          3.9MB

        • memory/1632-93-0x0000000000400000-0x00000000007E4000-memory.dmp
          Filesize

          3.9MB

        • memory/1632-91-0x00000000007E2730-mapping.dmp
        • memory/1632-86-0x0000000000400000-0x00000000007E4000-memory.dmp
          Filesize

          3.9MB

        • memory/1632-87-0x0000000000400000-0x00000000007E4000-memory.dmp
          Filesize

          3.9MB

        • memory/1632-90-0x0000000000400000-0x00000000007E4000-memory.dmp
          Filesize

          3.9MB

        • memory/1632-92-0x0000000000400000-0x00000000007E4000-memory.dmp
          Filesize

          3.9MB

        • memory/1868-105-0x0000000000000000-mapping.dmp
        • memory/1924-75-0x0000000000430000-0x0000000000814000-memory.dmp
          Filesize

          3.9MB

        • memory/1924-69-0x0000000000430000-0x0000000000814000-memory.dmp
          Filesize

          3.9MB

        • memory/1924-81-0x00000000001A0000-0x00000000001AA000-memory.dmp
          Filesize

          40KB

        • memory/1924-77-0x0000000000430000-0x0000000000814000-memory.dmp
          Filesize

          3.9MB

        • memory/1924-82-0x00000000001A0000-0x00000000001AA000-memory.dmp
          Filesize

          40KB

        • memory/1924-78-0x00000000001A0000-0x00000000001AA000-memory.dmp
          Filesize

          40KB

        • memory/1924-70-0x0000000000430000-0x0000000000814000-memory.dmp
          Filesize

          3.9MB

        • memory/1924-80-0x0000000000430000-0x0000000000814000-memory.dmp
          Filesize

          3.9MB

        • memory/1924-68-0x00000000007E2730-mapping.dmp
        • memory/1924-79-0x00000000001A0000-0x00000000001AA000-memory.dmp
          Filesize

          40KB

        • memory/1924-63-0x0000000000430000-0x0000000000814000-memory.dmp
          Filesize

          3.9MB

        • memory/1924-61-0x00000000006A2000-0x0000000000813000-memory.dmp
          Filesize

          1.4MB

        • memory/2000-59-0x0000000000000000-mapping.dmp
        • memory/2044-58-0x0000000000000000-mapping.dmp