Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2022 16:26

General

  • Target

    SecuriteInfo.com.Trojan.Heur.IEC.908d4036d15.20721.26030.exe

  • Size

    12KB

  • MD5

    9446b2b100fe2d17b7c81bcb977fa140

  • SHA1

    b43752fe1ade3fb7a7685807e7c8e717b4f410e7

  • SHA256

    4f96f60501192adf695845b23b45cd9ba0cb22e735c917494d59c004bc94283c

  • SHA512

    4243f2921bec8937452df1e437146cdbc8ba54f1bdb358aa4fa9a39a96e5025472c79714661f72e259eea67fd8971ea15d14604de1cb09e185a02443248ecd4d

  • SSDEEP

    192:3LfEjlawROqiqnxb2K8Z3O1TTgJMRqIcuuujP8:bfTPqDw3qTEKRtP

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

37.139.128.233:3569

Attributes
  • communication_password

    ce952068942604a6d6df06ed5002fad6

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • XenArmor Suite

    XenArmor is as suite of password recovery tools for various application.

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Heur.IEC.908d4036d15.20721.26030.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Heur.IEC.908d4036d15.20721.26030.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4444
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Heur.IEC.908d4036d15.20721.26030.exe
      C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Heur.IEC.908d4036d15.20721.26030.exe
      2⤵
        PID:1960
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Heur.IEC.908d4036d15.20721.26030.exe
        C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Heur.IEC.908d4036d15.20721.26030.exe
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4404
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Heur.IEC.908d4036d15.20721.26030.exe
          -a "C:\Users\Admin\AppData\Local\707c9a17\plg\l5iapjrF.json"
          3⤵
            PID:4944
          • C:\Users\Admin\AppData\Local\Temp\ovqBC432.exe
            -a "C:\Users\Admin\AppData\Local\707c9a17\plg\l5iapjrF.json"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4480
            • C:\Users\Admin\AppData\Local\Temp\ovqBC432.exe
              -a "C:\Users\Admin\AppData\Local\Temp\unk.xml"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Accesses Microsoft Outlook accounts
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1460

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\707c9a17\plg\l5iapjrF.json

        Filesize

        1KB

        MD5

        ce3e2f5f04eff81b3b7130a90a8e3a6e

        SHA1

        fe9ac39d1db0a28aeef54741003d3f639125dc1c

        SHA256

        b45d1dda071c8ee6b1078e8f71661ee1511887daf491a9f81415232a3c3bd631

        SHA512

        8cd831f9231cc30eeed546b47401459a2737d160faf0eacc823d286de22f79d68a95b994dce1f1eb6e7fa96e24aadeac50659115afe74148a33e6d31012ed357

      • C:\Users\Admin\AppData\Local\Temp\License.XenArmor

        Filesize

        104B

        MD5

        4f3bde9212e17ef18226866d6ac739b6

        SHA1

        732733bec8314beb81437e60876ffa75e72ae6cd

        SHA256

        212173a405c78d70f90e8ec0699a60ed2f4a9f3a8070de62eabd666c268fb174

        SHA512

        10b7cdae0b9a7b0f8e1bfc66a60675fa9b25c523864d5ae3da243f4e6e4c5194f3bd92af57ac956157442f66414bdd3393d0a1e5ba4ef0f192561e8524d4e744

      • C:\Users\Admin\AppData\Local\Temp\License.XenArmor

        Filesize

        104B

        MD5

        bf5da170f7c9a8eae88d1cb1a191ff80

        SHA1

        dd1b991a1b03587a5d1edc94e919a2070e325610

        SHA256

        e5d5110feb21939d82d962981aeaaafc4643b40a9b87cbed800ace82135d57cd

        SHA512

        9e32247d8556fd6efffbf7b6b9c325652d8c4b223b0fa38020879171476a49ab1f64d8897b5d8d92b79c5484fd9d5899be26ca5f664ee1f9c2acb0857084121e

      • C:\Users\Admin\AppData\Local\Temp\Unknown.dll

        Filesize

        793KB

        MD5

        86114faba7e1ec4a667d2bcb2e23f024

        SHA1

        670df6e1ba1dc6bece046e8b2e573dd36748245e

        SHA256

        568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d

        SHA512

        d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f

      • C:\Users\Admin\AppData\Local\Temp\Unknown.dll

        Filesize

        793KB

        MD5

        86114faba7e1ec4a667d2bcb2e23f024

        SHA1

        670df6e1ba1dc6bece046e8b2e573dd36748245e

        SHA256

        568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d

        SHA512

        d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f

      • C:\Users\Admin\AppData\Local\Temp\ovqBC432.exe

        Filesize

        402B

        MD5

        ca42e05f9d53c7ec9383307c1ea282bb

        SHA1

        ed0efa1b59b461dcda08121a39411bee72f6b4cb

        SHA256

        63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

        SHA512

        4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

      • C:\Users\Admin\AppData\Local\Temp\ovqBC432.exe

        Filesize

        402B

        MD5

        ca42e05f9d53c7ec9383307c1ea282bb

        SHA1

        ed0efa1b59b461dcda08121a39411bee72f6b4cb

        SHA256

        63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

        SHA512

        4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

      • C:\Users\Admin\AppData\Local\Temp\ovqBC432.exe

        Filesize

        402B

        MD5

        ca42e05f9d53c7ec9383307c1ea282bb

        SHA1

        ed0efa1b59b461dcda08121a39411bee72f6b4cb

        SHA256

        63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

        SHA512

        4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

      • C:\Users\Admin\AppData\Local\Temp\unk.xml

        Filesize

        1KB

        MD5

        ce3e2f5f04eff81b3b7130a90a8e3a6e

        SHA1

        fe9ac39d1db0a28aeef54741003d3f639125dc1c

        SHA256

        b45d1dda071c8ee6b1078e8f71661ee1511887daf491a9f81415232a3c3bd631

        SHA512

        8cd831f9231cc30eeed546b47401459a2737d160faf0eacc823d286de22f79d68a95b994dce1f1eb6e7fa96e24aadeac50659115afe74148a33e6d31012ed357

      • memory/1460-164-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/1460-169-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/1460-170-0x0000000010000000-0x0000000010227000-memory.dmp

        Filesize

        2.2MB

      • memory/1460-165-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/1460-171-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/1460-163-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/1460-160-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/1460-172-0x0000000010000000-0x0000000010227000-memory.dmp

        Filesize

        2.2MB

      • memory/1460-159-0x0000000000000000-mapping.dmp

      • memory/1960-142-0x0000000000000000-mapping.dmp

      • memory/2268-132-0x00000000005F0000-0x00000000005F8000-memory.dmp

        Filesize

        32KB

      • memory/2268-133-0x0000000005FF0000-0x0000000006012000-memory.dmp

        Filesize

        136KB

      • memory/4404-143-0x0000000000000000-mapping.dmp

      • memory/4404-146-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4404-177-0x0000000074EC0000-0x0000000074EF9000-memory.dmp

        Filesize

        228KB

      • memory/4404-144-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4404-145-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4404-147-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4404-150-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4404-148-0x0000000074B40000-0x0000000074B79000-memory.dmp

        Filesize

        228KB

      • memory/4404-149-0x0000000074EC0000-0x0000000074EF9000-memory.dmp

        Filesize

        228KB

      • memory/4444-137-0x0000000005B00000-0x0000000005B66000-memory.dmp

        Filesize

        408KB

      • memory/4444-136-0x0000000005420000-0x0000000005A48000-memory.dmp

        Filesize

        6.2MB

      • memory/4444-134-0x0000000000000000-mapping.dmp

      • memory/4444-135-0x0000000002890000-0x00000000028C6000-memory.dmp

        Filesize

        216KB

      • memory/4444-139-0x00000000061B0000-0x00000000061CE000-memory.dmp

        Filesize

        120KB

      • memory/4444-141-0x00000000066C0000-0x00000000066DA000-memory.dmp

        Filesize

        104KB

      • memory/4444-140-0x00000000077F0000-0x0000000007E6A000-memory.dmp

        Filesize

        6.5MB

      • memory/4444-138-0x0000000005B70000-0x0000000005BD6000-memory.dmp

        Filesize

        408KB

      • memory/4480-161-0x0000000000400000-0x00000000008DC000-memory.dmp

        Filesize

        4.9MB

      • memory/4480-157-0x0000000000400000-0x00000000008DC000-memory.dmp

        Filesize

        4.9MB

      • memory/4480-158-0x0000000000400000-0x00000000008DC000-memory.dmp

        Filesize

        4.9MB

      • memory/4480-175-0x0000000000400000-0x00000000008DC000-memory.dmp

        Filesize

        4.9MB

      • memory/4480-153-0x0000000000400000-0x00000000008DC000-memory.dmp

        Filesize

        4.9MB

      • memory/4480-152-0x0000000000000000-mapping.dmp

      • memory/4944-151-0x0000000000000000-mapping.dmp