Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-09-2022 08:46

General

  • Target

    PDF DOCUMENTO REFERENCIA Y CONTRA REFERENCIA ESE.exe

  • Size

    2.1MB

  • MD5

    b34182fc9f3f719d078e7b5183a31af0

  • SHA1

    2985c7f2c853c9680a1243e75283b6c1876ab0e7

  • SHA256

    baf8b869ca58cec88f07704770c521afcf050818df3280d7e2c79b1c8b75346c

  • SHA512

    2366e583b5fc90a778e59c3eeb22b277db71883ea74f2f67f777520bf9e573a1230fdfdbf978ffdb154eec23ce230f2f7bec3c8ad675371c3620624e74bb0d96

  • SSDEEP

    49152:8zlW4tpsVk5KwjVPh7zPEG3696usuUVruxYnOd5hPPukNvJ:8zMspsu5KwjvzPEI69OV6YnA77J

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

bless.con-ip.com:7777

Attributes
  • communication_password

    202cb962ac59075b964b07152d234b70

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PDF DOCUMENTO REFERENCIA Y CONTRA REFERENCIA ESE.exe
    "C:\Users\Admin\AppData\Local\Temp\PDF DOCUMENTO REFERENCIA Y CONTRA REFERENCIA ESE.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3136
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5016

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2484-132-0x00000000009D0000-0x0000000000BE2000-memory.dmp

    Filesize

    2.1MB

  • memory/2484-133-0x00000000059F0000-0x0000000005A12000-memory.dmp

    Filesize

    136KB

  • memory/3136-134-0x0000000000000000-mapping.dmp

  • memory/3136-135-0x0000000002920000-0x0000000002956000-memory.dmp

    Filesize

    216KB

  • memory/3136-136-0x0000000005010000-0x0000000005638000-memory.dmp

    Filesize

    6.2MB

  • memory/3136-137-0x00000000056E0000-0x0000000005746000-memory.dmp

    Filesize

    408KB

  • memory/3136-138-0x0000000005840000-0x00000000058A6000-memory.dmp

    Filesize

    408KB

  • memory/3136-139-0x0000000005EC0000-0x0000000005EDE000-memory.dmp

    Filesize

    120KB

  • memory/3136-140-0x0000000007720000-0x0000000007D9A000-memory.dmp

    Filesize

    6.5MB

  • memory/3136-141-0x00000000063A0000-0x00000000063BA000-memory.dmp

    Filesize

    104KB

  • memory/5016-142-0x0000000000000000-mapping.dmp

  • memory/5016-143-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/5016-144-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/5016-145-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/5016-146-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/5016-147-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/5016-148-0x0000000075100000-0x0000000075139000-memory.dmp

    Filesize

    228KB

  • memory/5016-149-0x0000000075480000-0x00000000754B9000-memory.dmp

    Filesize

    228KB

  • memory/5016-150-0x0000000075480000-0x00000000754B9000-memory.dmp

    Filesize

    228KB

  • memory/5016-151-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/5016-152-0x0000000075480000-0x00000000754B9000-memory.dmp

    Filesize

    228KB

  • memory/5016-153-0x0000000075480000-0x00000000754B9000-memory.dmp

    Filesize

    228KB

  • memory/5016-154-0x0000000075480000-0x00000000754B9000-memory.dmp

    Filesize

    228KB

  • memory/5016-155-0x0000000075100000-0x0000000075139000-memory.dmp

    Filesize

    228KB

  • memory/5016-156-0x0000000075480000-0x00000000754B9000-memory.dmp

    Filesize

    228KB

  • memory/5016-157-0x0000000075480000-0x00000000754B9000-memory.dmp

    Filesize

    228KB

  • memory/5016-158-0x0000000075480000-0x00000000754B9000-memory.dmp

    Filesize

    228KB

  • memory/5016-159-0x0000000075480000-0x00000000754B9000-memory.dmp

    Filesize

    228KB

  • memory/5016-160-0x0000000075480000-0x00000000754B9000-memory.dmp

    Filesize

    228KB