Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    07-09-2023 06:16

General

  • Target

    PAIN-Forms.exe

  • Size

    112KB

  • MD5

    a9db678b7bad6d2bae54505759452dd9

  • SHA1

    b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

  • SHA256

    5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

  • SHA512

    641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

  • SSDEEP

    1536:I7saA2chvktTeipnA5+PYpaqjxqYbKZCrXgMeYA5+PeOQT:I620vkt5pnAwlexvbKZwtAwET

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

smgqnt3eixxksasu.xyz:1234

Attributes
  • communication_password

    30afda4853ef5b1bc36463ba95d84247

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PAIN-Forms.exe
    "C:\Users\Admin\AppData\Local\Temp\PAIN-Forms.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "PAIN-Forms" /t REG_SZ /F /D "C:\Users\Admin\Documents\PAIN-Forms.pif"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2908
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "PAIN-Forms" /t REG_SZ /F /D "C:\Users\Admin\Documents\PAIN-Forms.pif"
        3⤵
        • Adds Run key to start application
        PID:1480
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c Copy "C:\Users\Admin\AppData\Local\Temp\PAIN-Forms.exe" "C:\Users\Admin\Documents\PAIN-Forms.pif"
      2⤵
        PID:2480
      • C:\Users\Admin\AppData\Local\Temp\PAIN-Forms.exe
        "C:\Users\Admin\AppData\Local\Temp\PAIN-Forms.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2636
        • C:\Users\Admin\AppData\Local\Temp\wWIidCwf27qXkfMW.exe
          "C:\Users\Admin\AppData\Local\Temp\wWIidCwf27qXkfMW.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2564
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "wWIidCwf27qXkfMW" /t REG_SZ /F /D "C:\Users\Admin\Documents\wWIidCwf27qXkfMW.pif"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1824
            • C:\Windows\SysWOW64\reg.exe
              REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "wWIidCwf27qXkfMW" /t REG_SZ /F /D "C:\Users\Admin\Documents\wWIidCwf27qXkfMW.pif"
              5⤵
              • Adds Run key to start application
              PID:2196
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c Copy "C:\Users\Admin\AppData\Local\Temp\wWIidCwf27qXkfMW.exe" "C:\Users\Admin\Documents\wWIidCwf27qXkfMW.pif"
            4⤵
              PID:756
            • C:\Users\Admin\AppData\Local\Temp\wWIidCwf27qXkfMW.exe
              "C:\Users\Admin\AppData\Local\Temp\wWIidCwf27qXkfMW.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of AdjustPrivilegeToken
              PID:1756

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JXO65VIN\PAIN-Forms[1].exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • C:\Users\Admin\AppData\Local\Temp\wWIidCwf27qXkfMW.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • C:\Users\Admin\AppData\Local\Temp\wWIidCwf27qXkfMW.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • C:\Users\Admin\AppData\Local\Temp\wWIidCwf27qXkfMW.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • \Users\Admin\AppData\Local\Temp\wWIidCwf27qXkfMW.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • \Users\Admin\AppData\Local\Temp\wWIidCwf27qXkfMW.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • \Users\Admin\AppData\Local\Temp\wWIidCwf27qXkfMW.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • \Users\Admin\AppData\Local\Temp\wWIidCwf27qXkfMW.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • \Users\Admin\AppData\Local\Temp\wWIidCwf27qXkfMW.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • memory/1288-4-0x0000000074200000-0x00000000748EE000-memory.dmp

        Filesize

        6.9MB

      • memory/1288-0-0x0000000074200000-0x00000000748EE000-memory.dmp

        Filesize

        6.9MB

      • memory/1288-20-0x0000000074200000-0x00000000748EE000-memory.dmp

        Filesize

        6.9MB

      • memory/1288-3-0x0000000005A40000-0x0000000005C38000-memory.dmp

        Filesize

        2.0MB

      • memory/1288-2-0x00000000005B0000-0x00000000005F0000-memory.dmp

        Filesize

        256KB

      • memory/1288-1-0x0000000001020000-0x0000000001042000-memory.dmp

        Filesize

        136KB

      • memory/1756-97-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/1756-98-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/1756-88-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2564-103-0x0000000004710000-0x0000000004750000-memory.dmp

        Filesize

        256KB

      • memory/2564-64-0x0000000001280000-0x00000000012A2000-memory.dmp

        Filesize

        136KB

      • memory/2564-65-0x0000000072FB0000-0x000000007369E000-memory.dmp

        Filesize

        6.9MB

      • memory/2564-66-0x0000000004710000-0x0000000004750000-memory.dmp

        Filesize

        256KB

      • memory/2564-93-0x0000000072FB0000-0x000000007369E000-memory.dmp

        Filesize

        6.9MB

      • memory/2636-18-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-25-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-32-0x0000000000090000-0x000000000009A000-memory.dmp

        Filesize

        40KB

      • memory/2636-33-0x0000000000090000-0x000000000009A000-memory.dmp

        Filesize

        40KB

      • memory/2636-34-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-35-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-36-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-38-0x0000000000090000-0x000000000009A000-memory.dmp

        Filesize

        40KB

      • memory/2636-39-0x0000000000090000-0x000000000009A000-memory.dmp

        Filesize

        40KB

      • memory/2636-40-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-41-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-42-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-44-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-30-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-28-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-27-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-26-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-31-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-24-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-23-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-62-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-22-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-21-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2636-69-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-15-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-13-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-14-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-11-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-95-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-12-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-9-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-101-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2636-7-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB