Loading malware…
BitPaymer, also known as Friedex, is Windows ransomware associated with Evil Corp, also tracked as INDRIK SPIDER. It came to prominence in 2017 and was used in targeted, high-value enterprise ransomware operations commonly termed big game hunting. Operators deployed it through access established by Dridex infections, including against domain-controlled systems. Its campaigns affected organizations primarily in North America, particularly the United States, and Western Europe, including financial institutions.
BitPaymer encrypts files in place using a separate 128-bit RC4 key for each file and an embedded RSA-1024 public key as part of its encryption scheme. It can enumerate remote systems and network shares in domains or workgroups using native Windows networking utilities. Defense-evasion behaviors include copying itself into an NTFS alternate data stream and dynamically resolving Windows APIs to reduce identifiable strings in its executable. It also modifies the Windows Registry to support execution and can bypass User Account Control on Windows 7 and Windows 10 to execute with elevated privileges.
BitPaymer shares substantial code and implementation similarities with Dridex, but its primary purpose is encrypting data for ransom rather than stealing banking information. DoppelPaymer emerged in 2019 as a fork of BitPaymer.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
6 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Indrik Spider has encrypted domain-controlled systems using BitPaymer.
Code for BitPaymer, also known as Friedex, includes numerous similarities to Dridex, despite its function as ransomware rather than data extraction.
BitPaymer, a ransomware variant operated by the threat actor with the self-styled name “Evil Corp” (a.k.a. the Dridex Group), was first introduced in 2017.
...as well as several ransomware strains including Locky, BitPaymer, Philadelphia, GlobeImposter, and Jaff on their targets' computers...
From 2018 to 2019, TA551 gave the BitPaymer ransomware group access to its botnet, helping infect 72 U.S. companies and generate over $14.17 million in extortion payments.
"From July 2017 to early 2020, GOLD DRAKE developed and distributed the BitPaymer ransomware during post-intrusion attacks facilitated by Dridex."
55 distinct techniques documented for this family, organized by ATT&CK tactic.
ils cherchent en premier lieu à prendre le contrôle de comptes administrateurs réseau légitimes afin de prendre pied sur des serveurs centraux de type « Active Directory »
They then sold access to infected computers to other criminals, who used them to launch ransomware attacks, locking victims out of systems and demanding cryptocurrency payments to restore access.
3.3 Point d’eau ... L’infection, par point d’eau ou par courriel d’hameçonnage pointant vers une URL malveillante, consiste en l’apparition d’une fausse mise à jour de navigateur, qui conduirait à l’installation du code malveillant FakeUpdates, puis de la propagation de Dridex
For example, a vulnerability in Apple WebKitGTK (CVE-2019-8720) received a CVE from Red Hat in October 2019 was added to the KEV catalog in March because it was being exploited by BitPaymer ransomware.
Initial Access Trusted Relationship Subcontractors or ESN compromises
Actors typically distribute Dridex malware through phishing e-mail spam campaigns.
In July 2019, BitPaymer’s victims were compromised via phishing campaigns [4]. ... Initial Access Spearphishing Attachment
In July 2019, BitPaymer’s victims were compromised via phishing campaigns [4]. ... Initial Access Spearphishing link
Execution Command-Line Interface arp / nslookup / etc.
Bitpaymer adds a .cmd file to the registry key (“HKCU\Software\Classes\mscfile\shell\open\command”)... and that, in turn, executes the .cmd file that runs the ransomware binary.
[BitPaymer](https://attack.mitre.org/software/S0570) has used dynamic API resolution to avoid identifiable strings within the binary, including <code>RegEnumKeyW</code>.(Citation: Crowdstrike Indrik November 2018)
Execution Service Execution Alternate Data Stream
Phase: Execution — Service Execution — exécution en tant qu’Alternate Data Stream
Both these ransomware use a similar User Account Controls bypass technique to elevate the clean, hijacked process to run the ransomware code... With WastedLocker, it uses winsat.exe and winmm.dll to run the ransomware binary (ADS component) by patching the winmm.dll.
ils cherchent en premier lieu à prendre le contrôle de comptes administrateurs réseau légitimes afin de prendre pied sur des serveurs centraux de type « Active Directory »
[BitPaymer](https://attack.mitre.org/software/S0570) can set values in the Registry to help in execution.(Citation: Crowdstrike Indrik November 2018)
They then sold access to infected computers to other criminals, who used them to launch ransomware attacks, locking victims out of systems and demanding cryptocurrency payments to restore access.
[BitPaymer](https://attack.mitre.org/software/S0570) has attempted to install itself as a service to maintain persistence.(Citation: Crowdstrike Indrik November 2018)
[BitPaymer](https://attack.mitre.org/software/S0570) has set the run key <code>HKCU\Software\Microsoft\Windows\CurrentVersion\Run</code> for persistence.(Citation: Crowdstrike Indrik November 2018)
Privilege Escalation Exploitation for Privilege Escalation Apple Update 0-day
ils cherchent en premier lieu à prendre le contrôle de comptes administrateurs réseau légitimes afin de prendre pied sur des serveurs centraux de type « Active Directory »
[BitPaymer](https://attack.mitre.org/software/S0570) can use the tokens of users to create processes on infected systems.(Citation: Crowdstrike Indrik November 2018)
[BitPaymer](https://attack.mitre.org/software/S0570) has attempted to install itself as a service to maintain persistence.(Citation: Crowdstrike Indrik November 2018)
[BitPaymer](https://attack.mitre.org/software/S0570) has set the run key <code>HKCU\Software\Microsoft\Windows\CurrentVersion\Run</code> for persistence.(Citation: Crowdstrike Indrik November 2018)
[BitPaymer](https://attack.mitre.org/software/S0570) can suppress UAC prompts by setting the <code>HKCU\Software\Classes\ms-settings\shell\open\command</code> registry key on Windows 10 or <code>HKCU\Software\Classes\mscfile\shell\open\command</code> on Windows 7 and launching the <code>eventvwr.msc</code> process, which launches [BitPaymer](https://attack.mitre.org/software/S0570) with elevated privileges.(Citation: Crowdstrike Indrik November 2018)
BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including RegEnumKeyW.
It’s also worth mentioning that both Dridex and FriedEx use the same malware packer.
It resolves all system API calls on the fly by searching for them by hash...
[BitPaymer](https://attack.mitre.org/software/S0570) has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.(Citation: Crowdstrike Indrik November 2018)
Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed
[BitPaymer](https://attack.mitre.org/software/S0570) can modify the timestamp of an executable so that it can be identified and restored by the decryption tool.(Citation: Crowdstrike Indrik November 2018)
ils cherchent en premier lieu à prendre le contrôle de comptes administrateurs réseau légitimes afin de prendre pied sur des serveurs centraux de type « Active Directory »
[BitPaymer](https://attack.mitre.org/software/S0570) can use the tokens of users to create processes on infected systems.(Citation: Crowdstrike Indrik November 2018)
Defense evasion Deobfuscate/Decode Files or Information
Defense evasion Exploitation for Defense Evasion Windows Defender
The malware finds a clean system file, copies itself to the clean file’s ADS, and then executes itself as a service component of the clean file. This makes it appear that the clean file is the source of the ransomware behavior.
[BitPaymer](https://attack.mitre.org/software/S0570) compares file names and paths to a list of excluded names and directory names during encryption.(Citation: Crowdstrike Indrik November 2018)
Func Antisandbox_by_diff_time( $val ) ... GetTickCount ... Sleep ... If Not (( $dif_time + 500 ) >= $val and ( $dif_time - 500 ) <= $val ) Then Exit EndIf
Persistence Hidden Files and Directories Alternate Data Stream
[BitPaymer](https://attack.mitre.org/software/S0570) has copied itself to the <code>:bin</code> alternate data stream of a newly created file.(Citation: Crowdstrike Indrik November 2018)
Both these ransomware use a similar User Account Controls bypass technique to elevate the clean, hijacked process to run the ransomware code... With WastedLocker, it uses winsat.exe and winmm.dll to run the ransomware binary (ADS component) by patching the winmm.dll.
[BitPaymer](https://attack.mitre.org/software/S0570) can set values in the Registry to help in execution.(Citation: Crowdstrike Indrik November 2018)
[BitPaymer](https://attack.mitre.org/software/S0570) can use <code>icacls /reset</code> and <code>takeown /F</code> to reset a targeted executable's permissions and then take ownership.(Citation: Crowdstrike Indrik November 2018)
In addition to the encryption of accessible files, BitPaymer is able to deactivate some AV products ... Defense evasion Disabling Security Tools Windows Defender
Use of Dridex banking trojan, Pentest tool Powershell Empire, credentials viewer tool Mimikatz and administration tool PsExec have been reported.
FriedEx focuses on higher profile targets and companies rather than regular end users and is usually delivered via an RDP brute force attack.
[BitPaymer](https://attack.mitre.org/software/S0570) can enumerate existing Windows services on the host that are configured to run as LocalSystem.(Citation: Crowdstrike Indrik November 2018)
[BitPaymer](https://attack.mitre.org/software/S0570) can use the RegEnumKeyW to iterate through Registry keys.(Citation: Crowdstrike Indrik November 2018)
[BitPaymer](https://attack.mitre.org/software/S0570) can use <code>net view</code> to discover remote systems.(Citation: Crowdstrike Indrik November 2018)
Ces comptes leurs servent à cartographier le réseau victime et identifier les ressources importantes.
Discovery System Network Connections Discovery
The malware finds a clean system file, copies itself to the clean file’s ADS, and then executes itself as a service component of the clean file.
To perform the propagation, Threat Actors firstly sought to compromise network administrators accounts ... Discovery Account Discovery
[BitPaymer](https://attack.mitre.org/software/S0570) can enumerate the sessions for each user logged onto the infected host.(Citation: Crowdstrike Indrik November 2018)
[BitPaymer](https://attack.mitre.org/software/S0570) can search for network shares on the domain or workgroup using <code>net view <host></code>.(Citation: Crowdstrike Indrik November 2018)
Func Antisandbox_by_diff_time( $val ) ... GetTickCount ... Sleep ... If Not (( $dif_time + 500 ) >= $val and ( $dif_time - 500 ) <= $val ) Then Exit EndIf
It has also been observed to be delivered through weakly protected RDP accesses [1]. ... extensive use of RDP connections could help detect lateralization phase of a BitPaymer attack.
Use of Dridex banking trojan, Pentest tool Powershell Empire, credentials viewer tool Mimikatz and administration tool PsExec have been reported. After taking over the network’s administrators accounts, Threat Actors use them to deploy the ransomware
The response can be a simple acknowledgment or a longer set of instructions, a module or executable... In many cases the C2 server response only contains an updated version of the binary... If the victim is infected with the latest version of Emotet... the latest modules are downloaded.
What they all have in common is that they both exfiltrate and encrypt files, then publish files as leverage in their ransom payment negotiations.
Once downloaded and active, Dridex has a wide range of capabilities, from downloading additional software to establishing a virtual network to deletion of files.
[BitPaymer](https://attack.mitre.org/software/S0570) can import a hard-coded RSA 1024-bit public key, generate a 128-bit RC4 key for each file, and encrypt the file in place, appending <code>.locked</code> to the filename.(Citation: Crowdstrike Indrik November 2018)
[BitPaymer](https://attack.mitre.org/software/S0570) attempts to remove the backup shadow files from the host using <code>vssadmin.exe Delete Shadows /All /Quiet</code>.(Citation: Crowdstrike Indrik November 2018)
Impact Disk Content Wipe
DoppelPaymer has only started publishing data in the last few days... the group claims to have sold data stolen in previous incidents on the dark web.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
109 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.