Overview

overview

10

Static

static

d0266a288b...ce.exe

windows7_x64

10

d0266a288b...ce.exe

windows10_x64

10

Analysis

  • max time kernel
    154s
  • max time network
    141s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    21-01-2022 23:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d0266a288b4fb5fb9fc74829a16a30e430bbf96d2b9dc27cb4ae93c82d5c55ce.exe

  • Size

    2.4MB

  • MD5

    fc0765d29622555033b316243dfa0ffa

  • SHA1

    92393107b21ee9b9ebc068b0a74c49e2968d7361

  • SHA256

    d0266a288b4fb5fb9fc74829a16a30e430bbf96d2b9dc27cb4ae93c82d5c55ce

  • SHA512

    f0172c219d865620b9c11b68db9580477b8ad582bbb255c7bc7de6d40cb5d5d069bd7da5a93f998e74cefe90a9fc38d42479a94f0b58cbc4bd807eecc200f294

Score
10/10
bitratpersistencetrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

jairoandresotalvarorend.linkpc.net:9086

Attributes
  • communication_password

    bfdba24ee3d61f0260c4dc1034c3ee43

  • install_dir

    windowsdefenderinitservices

  • install_file

    windowsdefenderinitservice.exe

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: RenamesItself 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d0266a288b4fb5fb9fc74829a16a30e430bbf96d2b9dc27cb4ae93c82d5c55ce.exe
    "C:\Users\Admin\AppData\Local\Temp\d0266a288b4fb5fb9fc74829a16a30e430bbf96d2b9dc27cb4ae93c82d5c55ce.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Users\Admin\AppData\Local\Temp\d0266a288b4fb5fb9fc74829a16a30e430bbf96d2b9dc27cb4ae93c82d5c55ce.exe
      "C:\Users\Admin\AppData\Local\Temp\d0266a288b4fb5fb9fc74829a16a30e430bbf96d2b9dc27cb4ae93c82d5c55ce.exe"
      2⤵
        PID:3564
      • C:\Users\Admin\AppData\Local\Temp\d0266a288b4fb5fb9fc74829a16a30e430bbf96d2b9dc27cb4ae93c82d5c55ce.exe
        "C:\Users\Admin\AppData\Local\Temp\d0266a288b4fb5fb9fc74829a16a30e430bbf96d2b9dc27cb4ae93c82d5c55ce.exe"
        2⤵
          PID:3616
        • C:\Users\Admin\AppData\Local\Temp\d0266a288b4fb5fb9fc74829a16a30e430bbf96d2b9dc27cb4ae93c82d5c55ce.exe
          "C:\Users\Admin\AppData\Local\Temp\d0266a288b4fb5fb9fc74829a16a30e430bbf96d2b9dc27cb4ae93c82d5c55ce.exe"
          2⤵
            PID:3648
          • C:\Users\Admin\AppData\Local\Temp\d0266a288b4fb5fb9fc74829a16a30e430bbf96d2b9dc27cb4ae93c82d5c55ce.exe
            "C:\Users\Admin\AppData\Local\Temp\d0266a288b4fb5fb9fc74829a16a30e430bbf96d2b9dc27cb4ae93c82d5c55ce.exe"
            2⤵
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: RenamesItself
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:3664

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Privilege Escalation

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2664-118-0x0000000000390000-0x00000000005F4000-memory.dmp
          Filesize

          2.4MB

          Download
        • memory/2664-119-0x0000000007280000-0x00000000074AA000-memory.dmp
          Filesize

          2.2MB

          Download
        • memory/2664-120-0x000000000A550000-0x000000000A5EC000-memory.dmp
          Filesize

          624KB

          Download
        • memory/2664-121-0x000000000AAF0000-0x000000000AFEE000-memory.dmp
          Filesize

          5.0MB

          Download
        • memory/2664-122-0x000000000A5F0000-0x000000000A682000-memory.dmp
          Filesize

          584KB

          Download
        • memory/2664-123-0x000000000A520000-0x000000000A52A000-memory.dmp
          Filesize

          40KB

          Download
        • memory/2664-124-0x000000000A7B0000-0x000000000A806000-memory.dmp
          Filesize

          344KB

          Download
        • memory/2664-125-0x0000000004DB0000-0x0000000004DF1000-memory.dmp
          Filesize

          260KB

          Download
        • memory/2664-126-0x0000000004880000-0x0000000004898000-memory.dmp
          Filesize

          96KB

          Download
        • memory/2664-127-0x0000000015F50000-0x0000000016112000-memory.dmp
          Filesize

          1.8MB

          Download
        • memory/2664-128-0x0000000016110000-0x000000001628A000-memory.dmp
          Filesize

          1.5MB

          Download
        • memory/3664-129-0x0000000000400000-0x00000000007E4000-memory.dmp
          Filesize

          3.9MB

          Download
        • memory/3664-130-0x0000000000400000-0x00000000007E4000-memory.dmp
          Filesize

          3.9MB

          Download
        • memory/3664-131-0x0000000000400000-0x00000000007E4000-memory.dmp
          Filesize

          3.9MB

          Download