Malware Analysis Report

2025-01-03 05:14

Sample ID 221130-qpw1ladg78
Target 36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019
SHA256 36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019
Tags
bitrat evasion trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019

Threat Level: Known bad

The file 36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019 was found to be: Known bad.

Malicious Activity Summary

bitrat evasion trojan

BitRAT

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Uses the VBS compiler for execution

Checks BIOS information in registry

Maps connected drives based on registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-30 13:26

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-30 13:26

Reported

2022-12-02 10:49

Platform

win7-20220901-en

Max time kernel

145s

Max time network

116s

Command Line

"C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe"

Signatures

BitRAT

trojan bitrat

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe N/A

Uses the VBS compiler for execution

Maps connected drives based on registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1672 set thread context of 992 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1672 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\SysWOW64\schtasks.exe
PID 1672 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\SysWOW64\schtasks.exe
PID 1672 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\SysWOW64\schtasks.exe
PID 1672 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\SysWOW64\schtasks.exe
PID 1672 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1672 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1672 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1672 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1672 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1672 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1672 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1672 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1672 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1672 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1672 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1672 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe

"C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vxfvdSvXkmR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB53C.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 logonapplication.ddns.net udp

Files

memory/1672-54-0x00000000013B0000-0x0000000001856000-memory.dmp

memory/1672-55-0x0000000075111000-0x0000000075113000-memory.dmp

memory/1672-56-0x0000000000470000-0x000000000047A000-memory.dmp

memory/1672-57-0x00000000080E0000-0x00000000084D2000-memory.dmp

memory/1480-58-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB53C.tmp

MD5 f415df40cb6b6a7a56a5dc306a7b9aa9
SHA1 e3064d6260c2c460872ea69a6e6be0dfa1219d67
SHA256 74a54b213cc878ea4ea39d47a92ce71944372269cd302fcce9df3e080f182481
SHA512 b46138be0c941c845fdfed143e36748d42268cee72a859f995fa50d7d16f8d20e524621b3302db409b90bb22453d3d47ebcbb2a542eb446b6ab84a2083aee515

memory/992-60-0x0000000000400000-0x00000000007CD000-memory.dmp

memory/992-61-0x0000000000400000-0x00000000007CD000-memory.dmp

memory/992-63-0x0000000000400000-0x00000000007CD000-memory.dmp

memory/992-65-0x0000000000400000-0x00000000007CD000-memory.dmp

memory/992-67-0x0000000000400000-0x00000000007CD000-memory.dmp

memory/992-69-0x0000000000400000-0x00000000007CD000-memory.dmp

memory/992-70-0x0000000000400000-0x00000000007CD000-memory.dmp

memory/992-75-0x0000000000400000-0x00000000007CD000-memory.dmp

memory/992-72-0x0000000000400000-0x00000000007CD000-memory.dmp

memory/992-73-0x0000000000689A84-mapping.dmp

memory/992-77-0x0000000000400000-0x00000000007CD000-memory.dmp

memory/992-78-0x0000000000400000-0x00000000007CD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-30 13:26

Reported

2022-12-02 10:49

Platform

win10v2004-20220901-en

Max time kernel

107s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe"

Signatures

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe N/A

Uses the VBS compiler for execution

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5068 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\SysWOW64\schtasks.exe
PID 5068 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\SysWOW64\schtasks.exe
PID 5068 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\SysWOW64\schtasks.exe
PID 5068 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 5068 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 5068 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 5068 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 5068 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 5068 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 5068 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 5068 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 5068 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 5068 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 5068 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 5068 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 5068 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 5068 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 5068 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe

"C:\Users\Admin\AppData\Local\Temp\36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vxfvdSvXkmR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp504E.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

Network

Country Destination Domain Proto
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp
N/A 2.18.109.224:443 tcp
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp

Files

memory/5068-132-0x0000000000370000-0x0000000000816000-memory.dmp

memory/5068-133-0x00000000076B0000-0x000000000774C000-memory.dmp

memory/5068-134-0x0000000007D00000-0x00000000082A4000-memory.dmp

memory/5068-135-0x0000000007750000-0x00000000077E2000-memory.dmp

memory/5068-136-0x0000000007680000-0x000000000768A000-memory.dmp

memory/5068-137-0x0000000007950000-0x00000000079A6000-memory.dmp

memory/5068-138-0x0000000007B30000-0x0000000007B96000-memory.dmp

memory/3748-139-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp504E.tmp

MD5 4c10d8b4f1647a222071396b2d5cfc1a
SHA1 46bf962c567aac0c34d5f809fd89b52c79da570a
SHA256 a3d66df7e2dd6fa3ffadbe1245a7e645a919fce241e5ad5fb3d2d44df3b498c9
SHA512 15280055a543535c3857199d2a0948397370be1dc8115723f715a7909da806059652b07fa4efb7dc1610724184ac73c9ff97da2ec1399290475f0f1ecfb8330b

memory/5108-141-0x0000000000000000-mapping.dmp

memory/4288-142-0x0000000000000000-mapping.dmp

memory/4344-143-0x0000000000000000-mapping.dmp

memory/3564-144-0x0000000000000000-mapping.dmp

memory/3068-145-0x0000000000000000-mapping.dmp