bitpaymer | bbace4f48807035a5e868ae924426893f29edafce1a0b2feb51d278e7e2dd9d2

Analysis

max time kernel
172s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bbace4f48807035a5e868ae924426893f29edafce1a0b2feb51d278e7e2dd9d2.exe
Size 272KB
Sample240101-q6l7qaefa7
SHA256 bbace4f48807035a5e868ae924426893f29edafce1a0b2feb51d278e7e2dd9d2
MD5 34441b7389336a401f4a9acb79172e40
SHA1 fcd96cd18b8ca9d33e50c3cfd3d1b9e2441acbdf
SHA512 044e2c2f53d8dc3594a1f949a9ae4f2d4709ecf22204627a9aa82f4da152381059c36db5c44ceba290b65d11d6beb2ef5c127879ca5e27a9fb8dc08bd8128661
SSDEEP 3072:CQqE6DDDf22bL7bCJ+2TmOJjvodM3lW0uEcScV9d/2UCMKM:HqE6/DjnChTfJjvodIW0uEcScV9d/2p
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bitpaymer backdoor discovery evasion exploit persistence ransomware trojan

Malware Config

Signatures

BitPaymer
Bitpaymer is a Trojan horse that encrypts files on a computer.
ransomware backdoor bitpaymer
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
3988	takeown.exe
1656	icacls.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Fax\ImagePath = "C:\\Windows\\system32\\fxssvc.exe"	K2DB5Z~1:bin

Windows Defender anti-emulation file check 1 TTPs 4 IoCs

Defender's emulator always creates certain fake files which can be used to detect it.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\aaa_TouchMeNot_.txt	bbace4f48807035a5e868ae924426893f29edafce1a0b2feb51d278e7e2dd9d2.exe
File opened (read-only)	C:\aaa_TouchMeNot_.txt	K2DB5Z~1:bin
File opened (read-only)	C:\aaa_TouchMeNot_.txt	fxssvc.exe
File opened (read-only)	C:\aaa_TouchMeNot_.txt	XGD4JFz:bin

Deletes itself 1 IoCs

pid	Process
1720	K2DB5Z~1:bin

Executes dropped EXE 3 IoCs

pid	Process
1720	K2DB5Z~1:bin
680	fxssvc.exe
4032	XGD4JFz:bin

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3988	takeown.exe
1656	icacls.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bbace4f48807035a5e868ae924426893f29edafce1a0b2feb51d278e7e2dd9d2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	K2DB5Z~1:bin
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fxssvc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	XGD4JFz:bin

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\fxssvc.exe:0	K2DB5Z~1:bin
File opened for modification	C:\Windows\system32\fxssvc.exe	K2DB5Z~1:bin

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\BackupCompress.M2T.0riz0n_readme	fxssvc.exe
File opened for modification	C:\Program Files\BlockSync.lnk.0riz0n_readme	fxssvc.exe
File opened for modification	C:\Program Files\ConfirmDismount.xls.0riz0n_readme	fxssvc.exe
File opened for modification	C:\Program Files\ApproveReset.mp3.0riz0n	fxssvc.exe
File created	C:\Program Files\BackupCompress.M2T.0riz0n_readme	fxssvc.exe
File opened for modification	C:\Program Files\BlockSync.lnk.0riz0n	fxssvc.exe
File opened for modification	C:\Program Files\CompressRegister.xsl.0riz0n_readme	fxssvc.exe
File created	C:\Program Files\CompressRegister.xsl.0riz0n_readme	fxssvc.exe
File opened for modification	C:\Program Files\BackupCompress.M2T	fxssvc.exe
File created	C:\Program Files\BlockSync.lnk.0riz0n_readme	fxssvc.exe
File opened for modification	C:\Program Files\CompressRegister.xsl	fxssvc.exe
File opened for modification	C:\Program Files\ConfirmDismount.xls	fxssvc.exe
File created	C:\Program Files\ConfirmDismount.xls.0riz0n_readme	fxssvc.exe
File opened for modification	C:\Program Files\DenyInvoke.htm	fxssvc.exe
File opened for modification	C:\Program Files\ApproveReset.mp3	fxssvc.exe
File opened for modification	C:\Program Files\ApproveReset.mp3.0riz0n_readme	fxssvc.exe
File created	C:\Program Files\ApproveReset.mp3.0riz0n_readme	fxssvc.exe
File opened for modification	C:\Program Files\BackupCompress.M2T.0riz0n	fxssvc.exe
File opened for modification	C:\Program Files\BlockSync.lnk	fxssvc.exe
File opened for modification	C:\Program Files\CompressRegister.xsl.0riz0n	fxssvc.exe
File opened for modification	C:\Program Files\ConfirmDismount.xls.0riz0n	fxssvc.exe

Discovers systems in the same network 1 TTPs 2 IoCs

discovery

Remote System Discovery

T1018

pid	Process
836	net.exe
3768	net.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3612	vssadmin.exe
1520	vssadmin.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\K2DB5Z~1:bin	bbace4f48807035a5e868ae924426893f29edafce1a0b2feb51d278e7e2dd9d2.exe
File created	C:\Users\Admin\AppData\Roaming\XGD4JFz:bin	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
680	fxssvc.exe
680	fxssvc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	4740	vssvc.exe
Token: SeRestorePrivilege	4740	vssvc.exe
Token: SeAuditPrivilege	4740	vssvc.exe
Token: SeTakeOwnershipPrivilege	3988	takeown.exe
Token: SeIncreaseQuotaPrivilege	680	fxssvc.exe
Token: SeAssignPrimaryTokenPrivilege	680	fxssvc.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1720	1108	bbace4f48807035a5e868ae924426893f29edafce1a0b2feb51d278e7e2dd9d2.exe	93
PID 1108 wrote to memory of 1720	1108	bbace4f48807035a5e868ae924426893f29edafce1a0b2feb51d278e7e2dd9d2.exe	93
PID 1108 wrote to memory of 1720	1108	bbace4f48807035a5e868ae924426893f29edafce1a0b2feb51d278e7e2dd9d2.exe	93
PID 1720 wrote to memory of 3612	1720	K2DB5Z~1:bin	94
PID 1720 wrote to memory of 3612	1720	K2DB5Z~1:bin	94
PID 1720 wrote to memory of 3988	1720	K2DB5Z~1:bin	97
PID 1720 wrote to memory of 3988	1720	K2DB5Z~1:bin	97
PID 1720 wrote to memory of 1656	1720	K2DB5Z~1:bin	99
PID 1720 wrote to memory of 1656	1720	K2DB5Z~1:bin	99
PID 680 wrote to memory of 4032	680	fxssvc.exe	104
PID 680 wrote to memory of 4032	680	fxssvc.exe	104
PID 680 wrote to memory of 4032	680	fxssvc.exe	104
PID 4032 wrote to memory of 1520	4032	XGD4JFz:bin	105
PID 4032 wrote to memory of 1520	4032	XGD4JFz:bin	105
PID 4032 wrote to memory of 2120	4032	XGD4JFz:bin	106
PID 4032 wrote to memory of 2120	4032	XGD4JFz:bin	106
PID 4032 wrote to memory of 3224	4032	XGD4JFz:bin	109
PID 4032 wrote to memory of 3224	4032	XGD4JFz:bin	109
PID 4032 wrote to memory of 3484	4032	XGD4JFz:bin	111
PID 4032 wrote to memory of 3484	4032	XGD4JFz:bin	111
PID 4032 wrote to memory of 3468	4032	XGD4JFz:bin	113
PID 4032 wrote to memory of 3468	4032	XGD4JFz:bin	113
PID 4032 wrote to memory of 4636	4032	XGD4JFz:bin	115
PID 4032 wrote to memory of 4636	4032	XGD4JFz:bin	115
PID 4032 wrote to memory of 2584	4032	XGD4JFz:bin	117
PID 4032 wrote to memory of 2584	4032	XGD4JFz:bin	117
PID 4032 wrote to memory of 4864	4032	XGD4JFz:bin	119
PID 4032 wrote to memory of 4864	4032	XGD4JFz:bin	119
PID 4032 wrote to memory of 3768	4032	XGD4JFz:bin	121
PID 4032 wrote to memory of 3768	4032	XGD4JFz:bin	121
PID 4032 wrote to memory of 384	4032	XGD4JFz:bin	123
PID 4032 wrote to memory of 384	4032	XGD4JFz:bin	123
PID 4032 wrote to memory of 836	4032	XGD4JFz:bin	127
PID 4032 wrote to memory of 836	4032	XGD4JFz:bin	127
PID 4032 wrote to memory of 3768	4032	XGD4JFz:bin	132
PID 4032 wrote to memory of 3768	4032	XGD4JFz:bin	132

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\bbace4f48807035a5e868ae924426893f29edafce1a0b2feb51d278e7e2dd9d2.exe
"C:\Users\Admin\AppData\Local\Temp\bbace4f48807035a5e868ae924426893f29edafce1a0b2feb51d278e7e2dd9d2.exe"
1⤵
- Windows Defender anti-emulation file check
- Checks whether UAC is enabled
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\AppData\Roaming\K2DB5Z~1:bin
  C:\Users\Admin\AppData\Roaming\K2DB5Z~1:bin C:\Users\Admin\AppData\Local\Temp\BBACE4~1.EXE
  2⤵
  - Sets service image path in registry
  - Windows Defender anti-emulation file check
  - Deletes itself
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:3612
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\fxssvc.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3988
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\fxssvc.exe /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2696

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Windows Defender anti-emulation file check
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680
- C:\Users\Admin\AppData\Roaming\XGD4JFz:bin
  C:\Users\Admin\AppData\Roaming\XGD4JFz:bin
  2⤵
  - Windows Defender anti-emulation file check
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1520
- - C:\Windows\system32\arp.exe
    C:\Windows\system32\\arp.exe -a
    3⤵
    PID:2120
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 10.127.0.1
    3⤵
    PID:3224
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 10.127.255.255
    3⤵
    PID:3484
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 167.235.102.93
    3⤵
    PID:3468
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 224.0.0.22
    3⤵
    PID:4636
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 224.0.0.251
    3⤵
    PID:2584
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 224.0.0.252
    3⤵
    PID:4864
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 239.255.255.250
    3⤵
    PID:3768
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 255.255.255.255
    3⤵
    PID:384
- - C:\Windows\system32\net.exe
    C:\Windows\system32\\net.exe view igmp.mcast.net
    3⤵
    - Discovers systems in the same network
    PID:836
- - C:\Windows\system32\net.exe
    C:\Windows\system32\\net.exe view mdns.mcast.net
    3⤵
    - Discovers systems in the same network
    PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

K2DB5Z~1:bin

Path C:\Users\Admin\AppData\Roaming\K2DB5Z~1:bin
Size 272KB
SHA256 bbace4f48807035a5e868ae924426893f29edafce1a0b2feb51d278e7e2dd9d2
MD5 34441b7389336a401f4a9acb79172e40
SHA1 fcd96cd18b8ca9d33e50c3cfd3d1b9e2441acbdf
SHA512 044e2c2f53d8dc3594a1f949a9ae4f2d4709ecf22204627a9aa82f4da152381059c36db5c44ceba290b65d11d6beb2ef5c127879ca5e27a9fb8dc08bd8128661
SSDEEP 3072:CQqE6DDDf22bL7bCJ+2TmOJjvodM3lW0uEcScV9d/2UCMKM:HqE6/DjnChTfJjvodIW0uEcScV9d/2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

N27BE.tmp

Path C:\Windows\Temp\N27BE.tmp
Size 91B
SHA256 16ceac4d7a9fd6d83e57269ccea3ed9917b7da5a2627c5814d48599230956b15
MD5 957322f83be1c9fcaef2ac8b2653bb45
SHA1 f41fa09cdce73242cc339905c233e3900c612b5b
SHA512 a04cff7e6456c5e62acacbdc6c63b0e4c8818c71b6e0152ed9cb630cd16ebeaee058e92a544836fc0235cdc0dd135ee590c4ffcfb1d58d08ca630c59184c19eb
MD5 SHA1 SHA512

Submit Download

ZLw392A.tmp

Path C:\Windows\Temp\ZLw392A.tmp
Size 35B
SHA256 02879b26713bb159566be8a2e3a183b3523fa5bdfb3cdfb5db864d8eaf523a61
MD5 943ae4d9b758363ed27d6fcd7d4c5d3a
SHA1 44abf78a1ad77a8fc709bf3d197fceeb4525adce
SHA512 88bf4e19b6ce0e3dbd9abdbb2abce7b397fa3a1cceffbe399f10b919a5b2d2270fbca3f58c6affe7c89b08526635c68fccf44340e2d5b80624dcfa6140f475f7
MD5 SHA1 SHA512

Submit Download

p4188.tmp

Path C:\Windows\Temp\p4188.tmp
Size 39B
SHA256 0e0218e94867a5f7f9d0723aba5049a6d8080d6a8188b5e81d3a5d65f8519870
MD5 19c3d9d5ce4d27968c32e02a252a6b7c
SHA1 63a851a55aafdd0a68a7751732219d1978e5d4b1
SHA512 dc051df571c43b36672ae7715f62075a2d0c95ad82da6c76c14f8a939e696a3de713f001fbabb9892e28fefc241d0a27c74df826a2597e76e1000de9e0daabb3
MD5 SHA1 SHA512

Submit Download

memory/680-14-0x00000000014D0000-0x00000000014D5000-memory.dmp

Download

memory/680-130-0x0000000000550000-0x0000000000596000-memory.dmp

Download

memory/680-206-0x0000000000550000-0x0000000000596000-memory.dmp

Download

memory/680-15-0x0000000000550000-0x0000000000596000-memory.dmp

Download

memory/680-190-0x0000000000550000-0x0000000000596000-memory.dmp

Download

memory/680-179-0x0000000000550000-0x0000000000596000-memory.dmp

Download

memory/680-168-0x0000000000550000-0x0000000000596000-memory.dmp

Download

memory/680-147-0x0000000000550000-0x0000000000596000-memory.dmp

Download

memory/680-141-0x0000000000550000-0x0000000000596000-memory.dmp

Download

memory/680-79-0x0000000000550000-0x0000000000596000-memory.dmp

Download

memory/680-124-0x0000000000550000-0x0000000000596000-memory.dmp

Download

memory/680-93-0x0000000000550000-0x0000000000596000-memory.dmp

Download

memory/680-94-0x0000000000550000-0x0000000000596000-memory.dmp

Download

memory/680-107-0x0000000000550000-0x0000000000596000-memory.dmp

Download

memory/680-116-0x0000000000550000-0x0000000000596000-memory.dmp

Download

memory/1108-1-0x0000000000C10000-0x0000000000C56000-memory.dmp

Download

memory/1108-7-0x0000000000C10000-0x0000000000C56000-memory.dmp

Download

memory/1108-0-0x0000000001250000-0x0000000001255000-memory.dmp

Download

memory/1720-9-0x00000000000A0000-0x00000000000E6000-memory.dmp

Download

memory/1720-8-0x0000000002070000-0x0000000002075000-memory.dmp

Download

memory/4032-80-0x0000000000CE0000-0x0000000000D26000-memory.dmp

Download

memory/4032-23-0x0000000000CE0000-0x0000000000D26000-memory.dmp

Download

memory/4032-22-0x0000000000CD0000-0x0000000000CD5000-memory.dmp

Download