Static

static

1

0ca40808fd...15.exe

windows7_x64

10

0ca40808fd...15.exe

windows10_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    21-10-2020 10:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0ca40808fdaccc210951a3c46bd79415.exe

  • Size

    1.7MB

  • MD5

    0ca40808fdaccc210951a3c46bd79415

  • SHA1

    d96423f7cce4bc21ba2d0aee774c7db85e84ab82

  • SHA256

    657a84ee835cf7d47f30fa352ab511e15ec8235bf7876f4264cf9885e10aee57

  • SHA512

    aa5de74739de5230086990c2f254938d2a5262b7771f088221932eba33fbb0b2767b79ff501803219b04fbbbeee7c042148d9ee004760e997701fc88264cc998

Score
10/10
bitratpersistencetrojanupx

Malware Config

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • BitRAT Payload 1 IoCs
  • Blocklisted process makes network request 4 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 3430 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 95 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ca40808fdaccc210951a3c46bd79415.exe
    "C:\Users\Admin\AppData\Local\Temp\0ca40808fdaccc210951a3c46bd79415.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3968
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe Aluminium,Excalibur
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2688
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
          PID:3392
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          3⤵
            PID:3984
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            3⤵
              PID:1556
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe"
              3⤵
              • Blocklisted process makes network request
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4016

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2688-3433-0x0000000007160000-0x0000000007508000-memory.dmp

          Filesize

          3.7MB

          Download

        • memory/4016-3435-0x0000000000400000-0x00000000007A8000-memory.dmp

          Filesize

          3.7MB

          Download

        • memory/4016-3436-0x0000000000400000-0x00000000007A8000-memory.dmp

          Filesize

          3.7MB

          Download