Resubmissions

09-09-2022 18:33

220909-w7e3pagha5 10

09-09-2022 18:17

220909-wxb82scehp 10

Analysis

  • max time kernel
    154s
  • max time network
    161s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    09-09-2022 18:17

General

  • Target

    BILLPAYM.exe

  • Size

    300.0MB

  • MD5

    41d8a777ddc40a009a046f88900c0b80

  • SHA1

    25dfd72ffe79eb5884d27fead86f4886bed638de

  • SHA256

    e6844a84f9210b5803147c158c841404331177bf409dab05fecb3b3303d50347

  • SHA512

    e75f3bfc85ed1def013474d61d5ee936ce36f499e0e111a7a1264180b7c7cc0b9a35469c35549e14c5efccc105db509aa5935152aab4e028b038e12b126f4514

  • SSDEEP

    24576:R+GQ7D8nXiNeGFPQKpFCjI/teJb2Q/eF2YlIECXRPbSVKcS2nOI3lqaNJJxEJYsO:R+GaeGtpFC8/mb9ejKulkPaNJo

Score
10/10

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

newbithere.duckdns.org:2005

Attributes
  • communication_password

    827ccb0eea8a706c4c34a16891f84e7b

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BILLPAYM.exe
    "C:\Users\Admin\AppData\Local\Temp\BILLPAYM.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Windows.exe'" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Windows.exe'" /f
        3⤵
        • Creates scheduled task(s)
        PID:392
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\BILLPAYM.exe" "C:\Users\Admin\AppData\Roaming\Windows.exe"
      2⤵
        PID:1644
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:528
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {D6E2D0EE-8E54-4061-BCA2-649B407DB326} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Users\Admin\AppData\Roaming\Windows.exe
        C:\Users\Admin\AppData\Roaming\Windows.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1256
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Windows.exe'" /f
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2004
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Windows.exe'" /f
            4⤵
            • Creates scheduled task(s)
            PID:1208
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c copy "C:\Users\Admin\AppData\Roaming\Windows.exe" "C:\Users\Admin\AppData\Roaming\Windows.exe"
          3⤵
            PID:1320
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of AdjustPrivilegeToken
            PID:1372
        • C:\Users\Admin\AppData\Roaming\Windows.exe
          C:\Users\Admin\AppData\Roaming\Windows.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1060
          • C:\Windows\SysWOW64\cmd.exe
            "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Windows.exe'" /f
            3⤵
              PID:1940
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Windows.exe'" /f
                4⤵
                • Creates scheduled task(s)
                PID:1116
            • C:\Windows\SysWOW64\cmd.exe
              "cmd" /c copy "C:\Users\Admin\AppData\Roaming\Windows.exe" "C:\Users\Admin\AppData\Roaming\Windows.exe"
              3⤵
                PID:1736
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                3⤵
                  PID:1908

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Roaming\Windows.exe

              Filesize

              238.8MB

              MD5

              e1d49241e373e6bb2f6dc86c24f0149f

              SHA1

              38b6c229aaba10eacc3cd590d3ebb679df704314

              SHA256

              47afa144c77db336f5f2d45bffd7f9fd77459c2ab395c05cf9a33749b1f1c0d6

              SHA512

              eff3558d91abbf2b6c50558b1d33032d7ae7eee14ae1df990e40828579a547aac28f1fc065b75b9791f4cdc802fe7394075189a385ec090190b15cda7d744f30

            • C:\Users\Admin\AppData\Roaming\Windows.exe

              Filesize

              300.0MB

              MD5

              41d8a777ddc40a009a046f88900c0b80

              SHA1

              25dfd72ffe79eb5884d27fead86f4886bed638de

              SHA256

              e6844a84f9210b5803147c158c841404331177bf409dab05fecb3b3303d50347

              SHA512

              e75f3bfc85ed1def013474d61d5ee936ce36f499e0e111a7a1264180b7c7cc0b9a35469c35549e14c5efccc105db509aa5935152aab4e028b038e12b126f4514

            • C:\Users\Admin\AppData\Roaming\Windows.exe

              Filesize

              300.0MB

              MD5

              41d8a777ddc40a009a046f88900c0b80

              SHA1

              25dfd72ffe79eb5884d27fead86f4886bed638de

              SHA256

              e6844a84f9210b5803147c158c841404331177bf409dab05fecb3b3303d50347

              SHA512

              e75f3bfc85ed1def013474d61d5ee936ce36f499e0e111a7a1264180b7c7cc0b9a35469c35549e14c5efccc105db509aa5935152aab4e028b038e12b126f4514

            • memory/392-58-0x0000000000000000-mapping.dmp

            • memory/528-75-0x0000000000160000-0x000000000016A000-memory.dmp

              Filesize

              40KB

            • memory/528-70-0x0000000000400000-0x00000000007E4000-memory.dmp

              Filesize

              3.9MB

            • memory/528-60-0x0000000000400000-0x00000000007E4000-memory.dmp

              Filesize

              3.9MB

            • memory/528-62-0x0000000000400000-0x00000000007E4000-memory.dmp

              Filesize

              3.9MB

            • memory/528-63-0x0000000000400000-0x00000000007E4000-memory.dmp

              Filesize

              3.9MB

            • memory/528-64-0x00000000007E2730-mapping.dmp

            • memory/528-65-0x0000000000400000-0x00000000007E4000-memory.dmp

              Filesize

              3.9MB

            • memory/528-66-0x0000000000400000-0x00000000007E4000-memory.dmp

              Filesize

              3.9MB

            • memory/528-69-0x0000000000400000-0x00000000007E4000-memory.dmp

              Filesize

              3.9MB

            • memory/528-59-0x0000000000400000-0x00000000007E4000-memory.dmp

              Filesize

              3.9MB

            • memory/528-71-0x0000000000400000-0x00000000007E4000-memory.dmp

              Filesize

              3.9MB

            • memory/528-72-0x0000000000400000-0x00000000007E4000-memory.dmp

              Filesize

              3.9MB

            • memory/528-73-0x0000000000160000-0x000000000016A000-memory.dmp

              Filesize

              40KB

            • memory/528-74-0x0000000000160000-0x000000000016A000-memory.dmp

              Filesize

              40KB

            • memory/528-76-0x0000000000160000-0x000000000016A000-memory.dmp

              Filesize

              40KB

            • memory/940-56-0x0000000000000000-mapping.dmp

            • memory/1060-101-0x00000000002C0000-0x0000000000496000-memory.dmp

              Filesize

              1.8MB

            • memory/1060-99-0x0000000000000000-mapping.dmp

            • memory/1116-108-0x0000000000000000-mapping.dmp

            • memory/1208-84-0x0000000000000000-mapping.dmp

            • memory/1256-78-0x0000000000000000-mapping.dmp

            • memory/1256-80-0x00000000012E0000-0x00000000014B6000-memory.dmp

              Filesize

              1.8MB

            • memory/1320-83-0x0000000000000000-mapping.dmp

            • memory/1372-90-0x00000000007E2730-mapping.dmp

            • memory/1372-97-0x0000000000400000-0x00000000007E4000-memory.dmp

              Filesize

              3.9MB

            • memory/1372-98-0x0000000000400000-0x00000000007E4000-memory.dmp

              Filesize

              3.9MB

            • memory/1644-57-0x0000000000000000-mapping.dmp

            • memory/1700-55-0x0000000074E41000-0x0000000074E43000-memory.dmp

              Filesize

              8KB

            • memory/1700-54-0x0000000001180000-0x0000000001356000-memory.dmp

              Filesize

              1.8MB

            • memory/1736-104-0x0000000000000000-mapping.dmp

            • memory/1908-111-0x00000000007E2730-mapping.dmp

            • memory/1940-103-0x0000000000000000-mapping.dmp

            • memory/2004-82-0x0000000000000000-mapping.dmp