Analysis

  • max time kernel
    201s
  • max time network
    216s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-11-2022 07:44

General

  • Target

    32d4216d4ef2af912921fc2931c0bd88.exe

  • Size

    1.4MB

  • MD5

    32d4216d4ef2af912921fc2931c0bd88

  • SHA1

    3e79dd260b67ed27134246e9461d8878c7ac73e3

  • SHA256

    d1ecf0f3592c06329182cbcd25fa654bb48c441c0b54bfb5c4b40fbaa517cdbf

  • SHA512

    7a25bcf3954238ab946ce95dc4153518fe67e773845f2bd037eac64c93906223b3ec611a04160cc20f85c4afa0b7124c8eacb43667ecb3fdde2776698f5b2b37

  • SSDEEP

    24576:SndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzmmKNLyEi93L2:EXDFBU2iIBb0xY/6sUYYMKns0

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

nicehash.at:6000

Attributes
  • communication_password

    005f16f264f006578c55237781f36898

  • install_dir

    JavaHelper

  • install_file

    Java.exe

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • XenArmor Suite

    XenArmor is as suite of password recovery tools for various application.

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\32d4216d4ef2af912921fc2931c0bd88.exe
    "C:\Users\Admin\AppData\Local\Temp\32d4216d4ef2af912921fc2931c0bd88.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Users\Admin\AppData\Local\JavaHelper\Java.exe
      -a "C:\Users\Admin\AppData\Local\f7283604\plg\THX7cAP0.json"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:8
      • C:\Users\Admin\AppData\Local\JavaHelper\Java.exe
        -a "C:\Users\Admin\AppData\Local\Temp\unk.xml"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Accesses Microsoft Outlook accounts
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4632

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\JavaHelper\Java.exe

    Filesize

    1.4MB

    MD5

    32d4216d4ef2af912921fc2931c0bd88

    SHA1

    3e79dd260b67ed27134246e9461d8878c7ac73e3

    SHA256

    d1ecf0f3592c06329182cbcd25fa654bb48c441c0b54bfb5c4b40fbaa517cdbf

    SHA512

    7a25bcf3954238ab946ce95dc4153518fe67e773845f2bd037eac64c93906223b3ec611a04160cc20f85c4afa0b7124c8eacb43667ecb3fdde2776698f5b2b37

  • C:\Users\Admin\AppData\Local\JavaHelper\Java.exe

    Filesize

    1.4MB

    MD5

    32d4216d4ef2af912921fc2931c0bd88

    SHA1

    3e79dd260b67ed27134246e9461d8878c7ac73e3

    SHA256

    d1ecf0f3592c06329182cbcd25fa654bb48c441c0b54bfb5c4b40fbaa517cdbf

    SHA512

    7a25bcf3954238ab946ce95dc4153518fe67e773845f2bd037eac64c93906223b3ec611a04160cc20f85c4afa0b7124c8eacb43667ecb3fdde2776698f5b2b37

  • C:\Users\Admin\AppData\Local\JavaHelper\License.XenArmor

    Filesize

    104B

    MD5

    4f3bde9212e17ef18226866d6ac739b6

    SHA1

    732733bec8314beb81437e60876ffa75e72ae6cd

    SHA256

    212173a405c78d70f90e8ec0699a60ed2f4a9f3a8070de62eabd666c268fb174

    SHA512

    10b7cdae0b9a7b0f8e1bfc66a60675fa9b25c523864d5ae3da243f4e6e4c5194f3bd92af57ac956157442f66414bdd3393d0a1e5ba4ef0f192561e8524d4e744

  • C:\Users\Admin\AppData\Local\JavaHelper\License.XenArmor

    Filesize

    104B

    MD5

    bf5da170f7c9a8eae88d1cb1a191ff80

    SHA1

    dd1b991a1b03587a5d1edc94e919a2070e325610

    SHA256

    e5d5110feb21939d82d962981aeaaafc4643b40a9b87cbed800ace82135d57cd

    SHA512

    9e32247d8556fd6efffbf7b6b9c325652d8c4b223b0fa38020879171476a49ab1f64d8897b5d8d92b79c5484fd9d5899be26ca5f664ee1f9c2acb0857084121e

  • C:\Users\Admin\AppData\Local\JavaHelper\Unknown.dll

    Filesize

    793KB

    MD5

    86114faba7e1ec4a667d2bcb2e23f024

    SHA1

    670df6e1ba1dc6bece046e8b2e573dd36748245e

    SHA256

    568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d

    SHA512

    d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f

  • C:\Users\Admin\AppData\Local\JavaHelper\Unknown.dll

    Filesize

    793KB

    MD5

    86114faba7e1ec4a667d2bcb2e23f024

    SHA1

    670df6e1ba1dc6bece046e8b2e573dd36748245e

    SHA256

    568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d

    SHA512

    d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f

  • C:\Users\Admin\AppData\Local\Temp\unk.xml

    Filesize

    1KB

    MD5

    ce3e2f5f04eff81b3b7130a90a8e3a6e

    SHA1

    fe9ac39d1db0a28aeef54741003d3f639125dc1c

    SHA256

    b45d1dda071c8ee6b1078e8f71661ee1511887daf491a9f81415232a3c3bd631

    SHA512

    8cd831f9231cc30eeed546b47401459a2737d160faf0eacc823d286de22f79d68a95b994dce1f1eb6e7fa96e24aadeac50659115afe74148a33e6d31012ed357

  • C:\Users\Admin\AppData\Local\f7283604\plg\THX7cAP0.json

    Filesize

    1KB

    MD5

    ce3e2f5f04eff81b3b7130a90a8e3a6e

    SHA1

    fe9ac39d1db0a28aeef54741003d3f639125dc1c

    SHA256

    b45d1dda071c8ee6b1078e8f71661ee1511887daf491a9f81415232a3c3bd631

    SHA512

    8cd831f9231cc30eeed546b47401459a2737d160faf0eacc823d286de22f79d68a95b994dce1f1eb6e7fa96e24aadeac50659115afe74148a33e6d31012ed357

  • memory/8-161-0x0000000000400000-0x00000000008DC000-memory.dmp

    Filesize

    4.9MB

  • memory/8-154-0x0000000000400000-0x00000000008DC000-memory.dmp

    Filesize

    4.9MB

  • memory/8-140-0x0000000000000000-mapping.dmp

  • memory/8-141-0x0000000000400000-0x00000000008DC000-memory.dmp

    Filesize

    4.9MB

  • memory/8-144-0x0000000000400000-0x00000000008DC000-memory.dmp

    Filesize

    4.9MB

  • memory/8-145-0x0000000000400000-0x00000000008DC000-memory.dmp

    Filesize

    4.9MB

  • memory/2500-139-0x0000000074210000-0x0000000074249000-memory.dmp

    Filesize

    228KB

  • memory/2500-137-0x0000000074210000-0x0000000074249000-memory.dmp

    Filesize

    228KB

  • memory/2500-133-0x0000000074550000-0x0000000074589000-memory.dmp

    Filesize

    228KB

  • memory/2500-134-0x0000000074210000-0x0000000074249000-memory.dmp

    Filesize

    228KB

  • memory/2500-135-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/2500-136-0x0000000074210000-0x0000000074249000-memory.dmp

    Filesize

    228KB

  • memory/2500-132-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/2500-138-0x0000000074210000-0x0000000074249000-memory.dmp

    Filesize

    228KB

  • memory/4632-151-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB

  • memory/4632-156-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB

  • memory/4632-157-0x0000000010000000-0x0000000010227000-memory.dmp

    Filesize

    2.2MB

  • memory/4632-158-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB

  • memory/4632-146-0x0000000000000000-mapping.dmp

  • memory/4632-147-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB

  • memory/4632-150-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB

  • memory/4632-149-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB