Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
02/09/2022, 11:22
General
- Target 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe
- Size 4.3MB
- Sample220902-ngltjsdadq
- SHA256 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa
Malware Config
Extracted
-
bitrat
-
1.38
-
163.123.143.143:3569
-
communication_password
ce952068942604a6d6df06ed5002fad6
-
tor_process
tor
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
- ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Loads dropped DLL 1 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe"C:\Users\Admin\AppData\Local\Temp\1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe"C:\Users\Admin\AppData\Local\Temp\1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe-a "C:\Users\Admin\AppData\Local\5bdee7b8\plg\wexnkwHg.json"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe-a "C:\Users\Admin\AppData\Local\Temp\unk.xml"4⤵
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
wexnkwHg.json
License.XenArmor
License.XenArmor
Unknown.dll
Unknown.dll
unk.xml
memory/2268-163-0x0000000000400000-0x00000000008DC000-memory.dmp
memory/2268-148-0x0000000000400000-0x00000000008DC000-memory.dmp
memory/2268-143-0x0000000000400000-0x00000000008DC000-memory.dmp
memory/2268-145-0x0000000000400000-0x00000000008DC000-memory.dmp
memory/2268-146-0x0000000000400000-0x00000000008DC000-memory.dmp
memory/2268-147-0x0000000000400000-0x00000000008DC000-memory.dmp
memory/4784-139-0x0000000075000000-0x0000000075039000-memory.dmp
memory/4784-165-0x0000000075380000-0x00000000753B9000-memory.dmp
memory/4784-141-0x0000000000400000-0x00000000007CE000-memory.dmp
memory/4784-140-0x0000000075380000-0x00000000753B9000-memory.dmp
memory/4784-138-0x0000000000400000-0x00000000007CE000-memory.dmp
memory/4784-137-0x0000000000400000-0x00000000007CE000-memory.dmp
memory/4784-136-0x0000000000400000-0x00000000007CE000-memory.dmp
memory/4784-135-0x0000000000400000-0x00000000007CE000-memory.dmp
memory/4788-158-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/4788-159-0x0000000010000000-0x0000000010227000-memory.dmp
memory/4788-160-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/4788-157-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/4788-153-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/4788-152-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/4788-151-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/4788-150-0x0000000000400000-0x00000000006FE000-memory.dmp