Analysis

  • max time kernel
    50s
  • max time network
    86s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-09-2023 13:28

General

  • Target

    c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3_JC.exe

  • Size

    3.8MB

  • MD5

    6d4c3a4ff3637ec34f820172f897d476

  • SHA1

    d53fe8f0ecb0536088ec9be5247ab6627baf31cb

  • SHA256

    c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3

  • SHA512

    1ff5f4b215bedf6824c9c1932b5e8dbcbb8e459ee2839c598cc0f955b2948e25c5ce834b963ee1cf6ea22954e9c1fa4b102f117808f6dc8a4891b36c37d7e894

  • SSDEEP

    98304:HjHNSk7Z95fznvi8pzJzTGVDr0io7x9JgDQssR:DtSk7hvi8pzkVnYwQ

Score
10/10

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

185.225.75.68:3569

Attributes
  • communication_password

    0edcbe7d888380c49e7d1dcf67b6ea6e

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Users\Admin\AppData\Local\Temp\c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3_JC.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5096
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\pint"
      2⤵
        PID:4392
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3_JC.exe" "C:\Users\Admin\AppData\Roaming\pint\pint.exe"
        2⤵
          PID:640
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\pint\pint.exe'" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1988
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\pint\pint.exe'" /f
            3⤵
            • Creates scheduled task(s)
            PID:1020
      • C:\Users\Admin\AppData\Roaming\pint\pint.exe
        C:\Users\Admin\AppData\Roaming\pint\pint.exe
        1⤵
        • Executes dropped EXE
        PID:4236

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\pint\pint.exe

        Filesize

        332KB

        MD5

        8b7fc4a4ad7b71b10999a1464bf5ca7f

        SHA1

        8f4b73478624c1dca486699bf5a8753a1cdb2161

        SHA256

        f96065948074ba84b11079b8e2b27a312879db52d13141d3e4281eb273a45ef5

        SHA512

        283aa9d66c7af11299306070372fba9b6ae320399ab723cb6571ef330f9de4e12865c2fcb627b634c66a2e18533ae01bf120dba97d0604ad1064ec7325303824

      • C:\Users\Admin\AppData\Roaming\pint\pint.exe

        Filesize

        128KB

        MD5

        b3f1bf2d871aa25b54fd035b674a1b1b

        SHA1

        c78a60f4b9326a1dc433f128aea71c22c554f380

        SHA256

        629ced3b1fa9f56cba96e4ae1cd203f708278d75d28dc98e96569c065287d6e8

        SHA512

        c91689196eb23bbc7d5eeda1b17151a4b1524d0aabece9ca8e5e97643379f10c13edc61d2d8833c9eefd9e2228412f3f213843e573a15c3ed1f46ba363768706

      • memory/2056-10-0x0000000074D20000-0x00000000754D0000-memory.dmp

        Filesize

        7.7MB

      • memory/2056-1-0x0000000000E30000-0x0000000001208000-memory.dmp

        Filesize

        3.8MB

      • memory/2056-2-0x00000000062A0000-0x0000000006844000-memory.dmp

        Filesize

        5.6MB

      • memory/2056-3-0x0000000005CE0000-0x0000000005CF0000-memory.dmp

        Filesize

        64KB

      • memory/2056-4-0x0000000005CF0000-0x00000000060B8000-memory.dmp

        Filesize

        3.8MB

      • memory/2056-0-0x0000000074D20000-0x00000000754D0000-memory.dmp

        Filesize

        7.7MB

      • memory/5096-23-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-31-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-13-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-14-0x0000000074C30000-0x0000000074C69000-memory.dmp

        Filesize

        228KB

      • memory/5096-15-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-16-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-17-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-18-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-19-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-20-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-21-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-22-0x0000000074FB0000-0x0000000074FE9000-memory.dmp

        Filesize

        228KB

      • memory/5096-7-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-24-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-25-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-26-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-27-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-9-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-32-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-33-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-34-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-35-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-38-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-39-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-40-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-41-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-42-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-43-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-44-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-45-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-46-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-47-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-6-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/5096-5-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB