Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-09-2023 06:16

General

  • Target

    PAIN-Forms.exe

  • Size

    112KB

  • MD5

    a9db678b7bad6d2bae54505759452dd9

  • SHA1

    b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

  • SHA256

    5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

  • SHA512

    641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

  • SSDEEP

    1536:I7saA2chvktTeipnA5+PYpaqjxqYbKZCrXgMeYA5+PeOQT:I620vkt5pnAwlexvbKZwtAwET

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

smgqnt3eixxksasu.xyz:1234

Attributes
  • communication_password

    30afda4853ef5b1bc36463ba95d84247

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PAIN-Forms.exe
    "C:\Users\Admin\AppData\Local\Temp\PAIN-Forms.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "PAIN-Forms" /t REG_SZ /F /D "C:\Users\Admin\Documents\PAIN-Forms.pif"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4268
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "PAIN-Forms" /t REG_SZ /F /D "C:\Users\Admin\Documents\PAIN-Forms.pif"
        3⤵
        • Adds Run key to start application
        PID:1188
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c Copy "C:\Users\Admin\AppData\Local\Temp\PAIN-Forms.exe" "C:\Users\Admin\Documents\PAIN-Forms.pif"
      2⤵
        PID:4476
      • C:\Users\Admin\AppData\Local\Temp\PAIN-Forms.exe
        "C:\Users\Admin\AppData\Local\Temp\PAIN-Forms.exe"
        2⤵
        • Checks computer location settings
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5088
        • C:\Users\Admin\AppData\Local\Temp\zsQJUX9RMTSFoXme.exe
          "C:\Users\Admin\AppData\Local\Temp\zsQJUX9RMTSFoXme.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2976
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "zsQJUX9RMTSFoXme" /t REG_SZ /F /D "C:\Users\Admin\Documents\zsQJUX9RMTSFoXme.pif"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:560
            • C:\Windows\SysWOW64\reg.exe
              REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "zsQJUX9RMTSFoXme" /t REG_SZ /F /D "C:\Users\Admin\Documents\zsQJUX9RMTSFoXme.pif"
              5⤵
              • Adds Run key to start application
              PID:440
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c Copy "C:\Users\Admin\AppData\Local\Temp\zsQJUX9RMTSFoXme.exe" "C:\Users\Admin\Documents\zsQJUX9RMTSFoXme.pif"
            4⤵
              PID:2020
            • C:\Users\Admin\AppData\Local\Temp\zsQJUX9RMTSFoXme.exe
              "C:\Users\Admin\AppData\Local\Temp\zsQJUX9RMTSFoXme.exe"
              4⤵
              • Executes dropped EXE
              PID:4280
            • C:\Users\Admin\AppData\Local\Temp\zsQJUX9RMTSFoXme.exe
              "C:\Users\Admin\AppData\Local\Temp\zsQJUX9RMTSFoXme.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of AdjustPrivilegeToken
              PID:3708

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0XT81K5W\PAIN-Forms[1].exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • C:\Users\Admin\AppData\Local\Temp\zsQJUX9RMTSFoXme.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • C:\Users\Admin\AppData\Local\Temp\zsQJUX9RMTSFoXme.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • C:\Users\Admin\AppData\Local\Temp\zsQJUX9RMTSFoXme.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • C:\Users\Admin\AppData\Local\Temp\zsQJUX9RMTSFoXme.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • memory/2976-57-0x00000000055D0000-0x00000000055E0000-memory.dmp

        Filesize

        64KB

      • memory/2976-63-0x00000000055D0000-0x00000000055E0000-memory.dmp

        Filesize

        64KB

      • memory/2976-62-0x00000000729D0000-0x0000000073180000-memory.dmp

        Filesize

        7.7MB

      • memory/2976-56-0x00000000729D0000-0x0000000073180000-memory.dmp

        Filesize

        7.7MB

      • memory/2976-74-0x00000000729D0000-0x0000000073180000-memory.dmp

        Filesize

        7.7MB

      • memory/3708-78-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/3708-71-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/3708-73-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/3708-80-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/3708-79-0x0000000073070000-0x00000000730A9000-memory.dmp

        Filesize

        228KB

      • memory/3708-75-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4212-7-0x0000000005F20000-0x0000000005F96000-memory.dmp

        Filesize

        472KB

      • memory/4212-19-0x0000000074EA0000-0x0000000075650000-memory.dmp

        Filesize

        7.7MB

      • memory/4212-0-0x0000000074EA0000-0x0000000075650000-memory.dmp

        Filesize

        7.7MB

      • memory/4212-11-0x00000000076B0000-0x0000000007716000-memory.dmp

        Filesize

        408KB

      • memory/4212-10-0x0000000007750000-0x00000000077EC000-memory.dmp

        Filesize

        624KB

      • memory/4212-9-0x0000000004B80000-0x0000000004B90000-memory.dmp

        Filesize

        64KB

      • memory/4212-8-0x0000000005ED0000-0x0000000005EEE000-memory.dmp

        Filesize

        120KB

      • memory/4212-6-0x0000000074EA0000-0x0000000075650000-memory.dmp

        Filesize

        7.7MB

      • memory/4212-5-0x0000000004D60000-0x0000000004D6A000-memory.dmp

        Filesize

        40KB

      • memory/4212-4-0x0000000004B80000-0x0000000004B90000-memory.dmp

        Filesize

        64KB

      • memory/4212-3-0x0000000004BA0000-0x0000000004C32000-memory.dmp

        Filesize

        584KB

      • memory/4212-2-0x00000000050B0000-0x0000000005654000-memory.dmp

        Filesize

        5.6MB

      • memory/4212-1-0x0000000000190000-0x00000000001B2000-memory.dmp

        Filesize

        136KB

      • memory/5088-17-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-23-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-37-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-38-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-33-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-50-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-32-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-31-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-54-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-30-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-29-0x0000000075130000-0x0000000075169000-memory.dmp

        Filesize

        228KB

      • memory/5088-60-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-28-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-27-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-26-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-25-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-24-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-36-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-22-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-21-0x0000000074DB0000-0x0000000074DE9000-memory.dmp

        Filesize

        228KB

      • memory/5088-76-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-18-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-16-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-14-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-83-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-87-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-91-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-95-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-99-0x0000000074DB0000-0x0000000074DE9000-memory.dmp

        Filesize

        228KB

      • memory/5088-100-0x0000000075130000-0x0000000075169000-memory.dmp

        Filesize

        228KB

      • memory/5088-101-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-105-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5088-109-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB