bitrat | cfd11acb2343bcc79e51f5c9db8443e901894d7580b430aecf8338a71cf624de

Analysis

max time kernel
154s
max time network
160s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
27-07-2023 07:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vuodneyx.exe
Size

664KB
MD5

f07259a0cd92a6c0640ff1acd0d1a54d
SHA1

270cc877c9b6571ec2b5c593dfba4f8ea4c5c966
SHA256

cfd11acb2343bcc79e51f5c9db8443e901894d7580b430aecf8338a71cf624de
SHA512

6d134f7121ebc3b4a53164c1be21b5428dad5c3dd24336398a9e07c933ca42387f498e93beeb61c9274683e497a781839a5b97404f14c3cfe1363e09b1116f28
SSDEEP

12288:RCsgkm2i2+G9fQ17xbNQ2aD68JzLiZ0A7zM7AJ6c7M3aXf5DhPvZi:wsZM7bQ2ebhyPzMk4c7fv5Dh3

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

208.67.104.96:1234

Attributes

communication_password
81dc9bdb52d04dc20036dbd8313ed055
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

CanWrite.exenydaqqnx.exe

pid process

1948 CanWrite.exe
2696 nydaqqnx.exe
Loads dropped DLL 1 IoCs

Processes:

taskeng.exe

pid process

2136 taskeng.exe

pid	process
1948	CanWrite.exe
2696	nydaqqnx.exe

pid	process
2136	taskeng.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

nydaqqnx.exe

pid process

2696 nydaqqnx.exe
2696 nydaqqnx.exe
2696 nydaqqnx.exe
2696 nydaqqnx.exe
2696 nydaqqnx.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

CanWrite.exe

description pid process target process

PID 1948 set thread context of 1748 1948 CanWrite.exe AddInUtil.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exeAddInUtil.exe

pid process

1976 powershell.exe
1748 AddInUtil.exe
1748 AddInUtil.exe
1748 AddInUtil.exe
1748 AddInUtil.exe
1748 AddInUtil.exe

pid	process
2696	nydaqqnx.exe
2696	nydaqqnx.exe
2696	nydaqqnx.exe
2696	nydaqqnx.exe
2696	nydaqqnx.exe

description	pid	process	target process
PID 1948 set thread context of 1748	1948	CanWrite.exe	AddInUtil.exe

pid	process
1976	powershell.exe
1748	AddInUtil.exe
1748	AddInUtil.exe
1748	AddInUtil.exe
1748	AddInUtil.exe
1748	AddInUtil.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Vuodneyx.exepowershell.exeCanWrite.exeAddInUtil.exenydaqqnx.exe

description	pid	process
Token: SeDebugPrivilege	2804	Vuodneyx.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	1948	CanWrite.exe
Token: SeDebugPrivilege	1748	AddInUtil.exe
Token: SeDebugPrivilege	2696	nydaqqnx.exe
Token: SeShutdownPrivilege	2696	nydaqqnx.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

nydaqqnx.exe

pid process

2696 nydaqqnx.exe
2696 nydaqqnx.exe

pid	process
2696	nydaqqnx.exe
2696	nydaqqnx.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

taskeng.exetaskeng.exeCanWrite.exeAddInUtil.exe

description	pid	process	target process
PID 2032 wrote to memory of 1976	2032	taskeng.exe	powershell.exe
PID 2032 wrote to memory of 1976	2032	taskeng.exe	powershell.exe
PID 2032 wrote to memory of 1976	2032	taskeng.exe	powershell.exe
PID 2136 wrote to memory of 1948	2136	taskeng.exe	CanWrite.exe
PID 2136 wrote to memory of 1948	2136	taskeng.exe	CanWrite.exe
PID 2136 wrote to memory of 1948	2136	taskeng.exe	CanWrite.exe
PID 1948 wrote to memory of 1748	1948	CanWrite.exe	AddInUtil.exe
PID 1948 wrote to memory of 1748	1948	CanWrite.exe	AddInUtil.exe
PID 1948 wrote to memory of 1748	1948	CanWrite.exe	AddInUtil.exe
PID 1948 wrote to memory of 1748	1948	CanWrite.exe	AddInUtil.exe
PID 1948 wrote to memory of 1748	1948	CanWrite.exe	AddInUtil.exe
PID 1948 wrote to memory of 1748	1948	CanWrite.exe	AddInUtil.exe
PID 1948 wrote to memory of 1748	1948	CanWrite.exe	AddInUtil.exe
PID 1748 wrote to memory of 2696	1748	AddInUtil.exe	nydaqqnx.exe
PID 1748 wrote to memory of 2696	1748	AddInUtil.exe	nydaqqnx.exe
PID 1748 wrote to memory of 2696	1748	AddInUtil.exe	nydaqqnx.exe
PID 1748 wrote to memory of 2696	1748	AddInUtil.exe	nydaqqnx.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Vuodneyx.exe
"C:\Users\Admin\AppData\Local\Temp\Vuodneyx.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\system32\taskeng.exe
taskeng.exe {15DB1C15-7A86-4FA8-8B11-1F970FD23B22} S-1-5-21-3408354897-1169622894-3874090110-1000:WGWIREOE\Admin:S4U:
1⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\system32\taskeng.exe
taskeng.exe {F9AC0FCB-5BFD-4814-AB3F-A9116DE7AF62} S-1-5-21-3408354897-1169622894-3874090110-1000:WGWIREOE\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2136

C:\Users\Admin\AppData\Roaming\DayOfWeek\CanWrite.exe
C:\Users\Admin\AppData\Roaming\DayOfWeek\CanWrite.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748

C:\Users\Admin\AppData\Local\Temp\nydaqqnx.exe
"C:\Users\Admin\AppData\Local\Temp\nydaqqnx.exe"
4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2696

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nydaqqnx.exe
Filesize
3.8MB

MD5
441dedecb2564b6df1ad2942958636c4

SHA1
33c91b6ebe8578d28ead35ff25d928285eeabd2f

SHA256
91e3e2bf786f5f441fc7461e98a55de547152edab9c95d38e230ac32c64e7a16

SHA512
3daa070ca3be0edacc3927413ae05d390b8e1f78d0a6aedacf169eacbc794f342fa1ec2dfca10bd4ee2c273ac99cfae8d515d1e1eabea48a2beed4218115da22

Download Submit
C:\Users\Admin\AppData\Local\Temp\nydaqqnx.exe
Filesize
3.8MB

MD5
441dedecb2564b6df1ad2942958636c4

SHA1
33c91b6ebe8578d28ead35ff25d928285eeabd2f

SHA256
91e3e2bf786f5f441fc7461e98a55de547152edab9c95d38e230ac32c64e7a16

SHA512
3daa070ca3be0edacc3927413ae05d390b8e1f78d0a6aedacf169eacbc794f342fa1ec2dfca10bd4ee2c273ac99cfae8d515d1e1eabea48a2beed4218115da22

Download Submit
C:\Users\Admin\AppData\Local\Temp\nydaqqnx.exe
Filesize
3.8MB

MD5
441dedecb2564b6df1ad2942958636c4

SHA1
33c91b6ebe8578d28ead35ff25d928285eeabd2f

SHA256
91e3e2bf786f5f441fc7461e98a55de547152edab9c95d38e230ac32c64e7a16

SHA512
3daa070ca3be0edacc3927413ae05d390b8e1f78d0a6aedacf169eacbc794f342fa1ec2dfca10bd4ee2c273ac99cfae8d515d1e1eabea48a2beed4218115da22

Download Submit
C:\Users\Admin\AppData\Roaming\DayOfWeek\CanWrite.exe
Filesize
664KB

MD5
f07259a0cd92a6c0640ff1acd0d1a54d

SHA1
270cc877c9b6571ec2b5c593dfba4f8ea4c5c966

SHA256
cfd11acb2343bcc79e51f5c9db8443e901894d7580b430aecf8338a71cf624de

SHA512
6d134f7121ebc3b4a53164c1be21b5428dad5c3dd24336398a9e07c933ca42387f498e93beeb61c9274683e497a781839a5b97404f14c3cfe1363e09b1116f28

Download Submit
C:\Users\Admin\AppData\Roaming\DayOfWeek\CanWrite.exe
Filesize
664KB

MD5
f07259a0cd92a6c0640ff1acd0d1a54d

SHA1
270cc877c9b6571ec2b5c593dfba4f8ea4c5c966

SHA256
cfd11acb2343bcc79e51f5c9db8443e901894d7580b430aecf8338a71cf624de

SHA512
6d134f7121ebc3b4a53164c1be21b5428dad5c3dd24336398a9e07c933ca42387f498e93beeb61c9274683e497a781839a5b97404f14c3cfe1363e09b1116f28

Download Submit
\Users\Admin\AppData\Roaming\DayOfWeek\CanWrite.exe
Filesize
664KB

MD5
f07259a0cd92a6c0640ff1acd0d1a54d

SHA1
270cc877c9b6571ec2b5c593dfba4f8ea4c5c966

SHA256
cfd11acb2343bcc79e51f5c9db8443e901894d7580b430aecf8338a71cf624de

SHA512
6d134f7121ebc3b4a53164c1be21b5428dad5c3dd24336398a9e07c933ca42387f498e93beeb61c9274683e497a781839a5b97404f14c3cfe1363e09b1116f28

Download Submit
memory/1748-8831-0x0000000000140000-0x00000000001C0000-memory.dmp

Filesize
512KB

Download
memory/1748-8840-0x0000000000140000-0x00000000001C0000-memory.dmp

Filesize
512KB

Download
memory/1748-8832-0x0000000000140000-0x00000000001C0000-memory.dmp

Filesize
512KB

Download
memory/1748-8841-0x0000000000140000-0x00000000001C0000-memory.dmp

Filesize
512KB

Download
memory/1748-8830-0x0000000000140000-0x00000000001C0000-memory.dmp

Filesize
512KB

Download
memory/1748-7178-0x0000000000140000-0x00000000001C0000-memory.dmp

Filesize
512KB

Download
memory/1748-7115-0x000007FEF4AA0000-0x000007FEF548C000-memory.dmp

Filesize
9.9MB

Download
memory/1748-5919-0x0000000000140000-0x00000000001C0000-memory.dmp

Filesize
512KB

Download
memory/1748-5918-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/1748-5917-0x000007FEF4AA0000-0x000007FEF548C000-memory.dmp

Filesize
9.9MB

Download
memory/1948-4453-0x000007FEF4AA0000-0x000007FEF548C000-memory.dmp

Filesize
9.9MB

Download
memory/1948-5913-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/1948-5904-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/1948-5903-0x0000000000830000-0x0000000000884000-memory.dmp

Filesize
336KB

Download
memory/1948-4753-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/1948-5916-0x000007FEF4AA0000-0x000007FEF548C000-memory.dmp

Filesize
9.9MB

Download
memory/1948-2997-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/1948-2991-0x000000013FF80000-0x000000014002A000-memory.dmp

Filesize
680KB

Download
memory/1948-2990-0x000007FEF4AA0000-0x000007FEF548C000-memory.dmp

Filesize
9.9MB

Download
memory/1976-2977-0x0000000019E20000-0x000000001A102000-memory.dmp

Filesize
2.9MB

Download
memory/1976-2985-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Filesize
9.6MB

Download
memory/1976-2984-0x0000000001490000-0x0000000001510000-memory.dmp

Filesize
512KB

Download
memory/1976-2982-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Filesize
9.6MB

Download
memory/1976-2983-0x0000000000E50000-0x0000000000E58000-memory.dmp

Filesize
32KB

Download
memory/1976-2981-0x0000000001490000-0x0000000001510000-memory.dmp

Filesize
512KB

Download
memory/1976-2980-0x0000000001490000-0x0000000001510000-memory.dmp

Filesize
512KB

Download
memory/1976-2979-0x0000000001490000-0x0000000001510000-memory.dmp

Filesize
512KB

Download
memory/1976-2978-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Filesize
9.6MB

Download
memory/2696-8843-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/2696-8844-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/2804-87-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-93-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-1216-0x000000001B900000-0x000000001B980000-memory.dmp

Filesize
512KB

Download
memory/2804-2968-0x000000001AAF0000-0x000000001AB46000-memory.dmp

Filesize
344KB

Download
memory/2804-2969-0x0000000002320000-0x000000000236C000-memory.dmp

Filesize
304KB

Download
memory/2804-2970-0x000000001AF80000-0x000000001AFD4000-memory.dmp

Filesize
336KB

Download
memory/2804-2972-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

Filesize
9.9MB

Download
memory/2804-119-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-121-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-117-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-115-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-113-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-111-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-109-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-107-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-105-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-103-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-101-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-99-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-97-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-95-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-1112-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

Filesize
9.9MB

Download
memory/2804-91-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-89-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-54-0x000000013F700000-0x000000013F7AA000-memory.dmp

Filesize
680KB

Download
memory/2804-85-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-83-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-81-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-75-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-79-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-77-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-71-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-73-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-69-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-67-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-65-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-63-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-61-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-59-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-58-0x000000001B7C0000-0x000000001B8CC000-memory.dmp

Filesize
1.0MB

Download
memory/2804-57-0x000000001B7C0000-0x000000001B8D0000-memory.dmp

Filesize
1.1MB

Download
memory/2804-56-0x000000001B900000-0x000000001B980000-memory.dmp

Filesize
512KB

Download
memory/2804-55-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

Filesize
9.9MB

Download