Analysis
- max time kernel
150s - max time network
146s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
21/12/2021, 21:56
General
- Target 01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
- Size 2.7MB
- Sample211221-1tvnfaefe4
- SHA256 01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426
Malware Config
Extracted
-
bitrat
-
1.35
-
publiquilla.linkpc.net:9092
-
communication_password
bfdba24ee3d61f0260c4dc1034c3ee43
-
install_dir
System32dllwin
-
install_file
Systemwin32077273dll.exe
-
tor_process
tor
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: RenamesItself 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe"C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe"C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe"C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe"C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe"C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2544-115-0x0000000000700000-0x0000000000701000-memory.dmp
memory/2544-117-0x0000000005230000-0x0000000005231000-memory.dmp
memory/2544-118-0x0000000005870000-0x0000000005871000-memory.dmp
memory/2544-119-0x0000000005370000-0x0000000005371000-memory.dmp
memory/2544-120-0x0000000005370000-0x000000000586E000-memory.dmp
memory/2544-121-0x00000000051D0000-0x00000000051D1000-memory.dmp
memory/2544-122-0x00000000054F0000-0x00000000054F1000-memory.dmp
memory/2544-123-0x0000000005210000-0x0000000005224000-memory.dmp
memory/2544-124-0x0000000006330000-0x000000000650C000-memory.dmp
memory/2544-125-0x00000000098D0000-0x0000000009A5D000-memory.dmp
memory/2656-126-0x0000000000400000-0x00000000007E4000-memory.dmp
memory/2656-128-0x0000000000400000-0x00000000007E4000-memory.dmp
memory/2656-129-0x0000000000400000-0x00000000007E4000-memory.dmp