Static

static

1

0ca40808fd...15.exe

windows7_x64

10

0ca40808fd...15.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    21-10-2020 10:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0ca40808fdaccc210951a3c46bd79415.exe

  • Size

    1.7MB

  • MD5

    0ca40808fdaccc210951a3c46bd79415

  • SHA1

    d96423f7cce4bc21ba2d0aee774c7db85e84ab82

  • SHA256

    657a84ee835cf7d47f30fa352ab511e15ec8235bf7876f4264cf9885e10aee57

  • SHA512

    aa5de74739de5230086990c2f254938d2a5262b7771f088221932eba33fbb0b2767b79ff501803219b04fbbbeee7c042148d9ee004760e997701fc88264cc998

Score
10/10
bitratpersistencetrojanupx

Malware Config

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • BitRAT Payload 1 IoCs
  • Blocklisted process makes network request 4 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 3430 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ca40808fdaccc210951a3c46bd79415.exe
    "C:\Users\Admin\AppData\Local\Temp\0ca40808fdaccc210951a3c46bd79415.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe Aluminium,Excalibur
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2652
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Blocklisted process makes network request
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2680

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2652-3433-0x0000000002B30000-0x0000000002ED8000-memory.dmp

    Filesize

    3.7MB

    Download

  • memory/2680-3435-0x0000000000400000-0x00000000007A8000-memory.dmp

    Filesize

    3.7MB

    Download

  • memory/2680-3436-0x0000000000400000-0x00000000007A8000-memory.dmp

    Filesize

    3.7MB

    Download

  • memory/2680-3437-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2680-3438-0x00000000002F0000-0x00000000002F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2680-3439-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2680-3440-0x00000000002F0000-0x00000000002F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2680-3442-0x00000000002F0000-0x00000000002F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2680-3444-0x00000000002F0000-0x00000000002F1000-memory.dmp

    Filesize

    4KB

    Download