Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    07-09-2023 06:16

General

  • Target

    Stub.exe

  • Size

    3.8MB

  • MD5

    5d422b017137a0060e7de3b1ddff3fbb

  • SHA1

    fbc8138cc80dd477ec6bd45ade7bdd27de251260

  • SHA256

    c733abcd9c2a5c1734242bc3238dd44e9aaf7e2c01878bebe2751c1b99f9a658

  • SHA512

    b5794b69eb87e6e3f0fe19dfe0734a94fb342e27dc3e2936abd052d7cf8f82b672d28a250378b15c3631be6ce60a21643573d372a12917d5cbfa941f17fd4bdc

  • SSDEEP

    98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/7mlwXVZ4FB:5+R/eZADUXR

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

smgqnt3eixxksasu.xyz:1234

Attributes
  • communication_password

    30afda4853ef5b1bc36463ba95d84247

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Stub.exe
    "C:\Users\Admin\AppData\Local\Temp\Stub.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Users\Admin\AppData\Local\Temp\tuLZRYxusoYKOJpk.exe
      "C:\Users\Admin\AppData\Local\Temp\tuLZRYxusoYKOJpk.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2532
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "tuLZRYxusoYKOJpk" /t REG_SZ /F /D "C:\Users\Admin\Documents\tuLZRYxusoYKOJpk.pif"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2752
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "tuLZRYxusoYKOJpk" /t REG_SZ /F /D "C:\Users\Admin\Documents\tuLZRYxusoYKOJpk.pif"
          4⤵
          • Adds Run key to start application
          PID:2840
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c Copy "C:\Users\Admin\AppData\Local\Temp\tuLZRYxusoYKOJpk.exe" "C:\Users\Admin\Documents\tuLZRYxusoYKOJpk.pif"
        3⤵
          PID:1668
        • C:\Users\Admin\AppData\Local\Temp\tuLZRYxusoYKOJpk.exe
          "C:\Users\Admin\AppData\Local\Temp\tuLZRYxusoYKOJpk.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2464
          • C:\Users\Admin\AppData\Local\Temp\zeFKIrvPCv8kb2Qm.exe
            "C:\Users\Admin\AppData\Local\Temp\zeFKIrvPCv8kb2Qm.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2888
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "zeFKIrvPCv8kb2Qm" /t REG_SZ /F /D "C:\Users\Admin\Documents\zeFKIrvPCv8kb2Qm.pif"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:836
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "zeFKIrvPCv8kb2Qm" /t REG_SZ /F /D "C:\Users\Admin\Documents\zeFKIrvPCv8kb2Qm.pif"
                6⤵
                • Adds Run key to start application
                PID:1836
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c Copy "C:\Users\Admin\AppData\Local\Temp\zeFKIrvPCv8kb2Qm.exe" "C:\Users\Admin\Documents\zeFKIrvPCv8kb2Qm.pif"
              5⤵
                PID:1556
              • C:\Users\Admin\AppData\Local\Temp\zeFKIrvPCv8kb2Qm.exe
                "C:\Users\Admin\AppData\Local\Temp\zeFKIrvPCv8kb2Qm.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of AdjustPrivilegeToken
                PID:1344

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tuLZRYxusoYKOJpk.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • C:\Users\Admin\AppData\Local\Temp\tuLZRYxusoYKOJpk.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • C:\Users\Admin\AppData\Local\Temp\tuLZRYxusoYKOJpk.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • C:\Users\Admin\AppData\Local\Temp\tuLZRYxusoYKOJpk.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • C:\Users\Admin\AppData\Local\Temp\zeFKIrvPCv8kb2Qm.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • C:\Users\Admin\AppData\Local\Temp\zeFKIrvPCv8kb2Qm.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • C:\Users\Admin\AppData\Local\Temp\zeFKIrvPCv8kb2Qm.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • \Users\Admin\AppData\Local\Temp\tuLZRYxusoYKOJpk.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • \Users\Admin\AppData\Local\Temp\tuLZRYxusoYKOJpk.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • \Users\Admin\AppData\Local\Temp\tuLZRYxusoYKOJpk.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • \Users\Admin\AppData\Local\Temp\tuLZRYxusoYKOJpk.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • \Users\Admin\AppData\Local\Temp\tuLZRYxusoYKOJpk.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • \Users\Admin\AppData\Local\Temp\zeFKIrvPCv8kb2Qm.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • \Users\Admin\AppData\Local\Temp\zeFKIrvPCv8kb2Qm.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • \Users\Admin\AppData\Local\Temp\zeFKIrvPCv8kb2Qm.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • \Users\Admin\AppData\Local\Temp\zeFKIrvPCv8kb2Qm.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • \Users\Admin\AppData\Local\Temp\zeFKIrvPCv8kb2Qm.exe

        Filesize

        112KB

        MD5

        a9db678b7bad6d2bae54505759452dd9

        SHA1

        b0ab52df85ec1595f0a2d1f4e4d09552ea27505a

        SHA256

        5c362423456076e89659ae8ad2069d05a12ec769d27623fea060c4c7715e27ea

        SHA512

        641c8a32a821b557cb7050d4ccfa1dfd5f02d4e6d5ce88f1ce305e9887d17c40368829c89a8e7f64880acd368288ed55a1b0b363b0b0f8da833eae2bf4cb807a

      • memory/1248-2-0x0000000000200000-0x000000000020A000-memory.dmp

        Filesize

        40KB

      • memory/1248-3-0x0000000000200000-0x000000000020A000-memory.dmp

        Filesize

        40KB

      • memory/1248-0-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/1248-1-0x0000000000200000-0x000000000020A000-memory.dmp

        Filesize

        40KB

      • memory/1248-4-0x0000000000200000-0x000000000020A000-memory.dmp

        Filesize

        40KB

      • memory/1344-116-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/1344-125-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/1344-123-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-32-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-67-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-41-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-38-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-44-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-130-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-45-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-47-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-49-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-48-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-51-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-50-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-52-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-53-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-54-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-55-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-56-0x0000000000140000-0x000000000014A000-memory.dmp

        Filesize

        40KB

      • memory/2464-57-0x0000000000140000-0x000000000014A000-memory.dmp

        Filesize

        40KB

      • memory/2464-58-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-59-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-60-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-63-0x0000000000140000-0x000000000014A000-memory.dmp

        Filesize

        40KB

      • memory/2464-64-0x0000000000140000-0x000000000014A000-memory.dmp

        Filesize

        40KB

      • memory/2464-39-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2464-68-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-69-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-37-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-36-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-35-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-87-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-34-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-33-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-126-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2464-98-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/2532-24-0x00000000737D0000-0x0000000073EBE000-memory.dmp

        Filesize

        6.9MB

      • memory/2532-27-0x00000000737D0000-0x0000000073EBE000-memory.dmp

        Filesize

        6.9MB

      • memory/2532-26-0x0000000005B80000-0x0000000005D78000-memory.dmp

        Filesize

        2.0MB

      • memory/2532-25-0x0000000004770000-0x00000000047B0000-memory.dmp

        Filesize

        256KB

      • memory/2532-23-0x0000000001250000-0x0000000001272000-memory.dmp

        Filesize

        136KB

      • memory/2532-28-0x0000000004770000-0x00000000047B0000-memory.dmp

        Filesize

        256KB

      • memory/2532-46-0x00000000737D0000-0x0000000073EBE000-memory.dmp

        Filesize

        6.9MB

      • memory/2888-91-0x0000000004D50000-0x0000000004D90000-memory.dmp

        Filesize

        256KB

      • memory/2888-96-0x00000000730E0000-0x00000000737CE000-memory.dmp

        Filesize

        6.9MB

      • memory/2888-97-0x0000000004D50000-0x0000000004D90000-memory.dmp

        Filesize

        256KB

      • memory/2888-89-0x00000000730E0000-0x00000000737CE000-memory.dmp

        Filesize

        6.9MB

      • memory/2888-121-0x00000000730E0000-0x00000000737CE000-memory.dmp

        Filesize

        6.9MB

      • memory/2888-90-0x00000000008E0000-0x0000000000902000-memory.dmp

        Filesize

        136KB