Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
10/05/2022, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
481af38f33f4dc59c30d304ce466c4f0.exe
Resource
win7-20220414-en
General
-
Target
481af38f33f4dc59c30d304ce466c4f0.exe
-
Size
6.1MB
-
MD5
481af38f33f4dc59c30d304ce466c4f0
-
SHA1
ff0760bff63c33a71c93c84542402e8501d00627
-
SHA256
39b2d2d422f4f87347f8b91009544a91115af8203fdb0afa7bf7f57cdec531e7
-
SHA512
8225330df7a6f466ac9946e83cf1c50dde54cf4e330e8a1136a4837112766b3dc459ff6a6202e419e56f876986ae7549b889e8a85cbccefe6ec57dc1e7cd688e
Malware Config
Extracted
bitrat
1.38
https.myvnc.com:9111
-
communication_password
c4ca4238a0b923820dcc509a6f75849b
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Executes dropped EXE 1 IoCs
pid Process 940 AddInProcess32.exe -
Loads dropped DLL 1 IoCs
pid Process 848 481af38f33f4dc59c30d304ce466c4f0.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 940 AddInProcess32.exe 940 AddInProcess32.exe 940 AddInProcess32.exe 940 AddInProcess32.exe 940 AddInProcess32.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 848 set thread context of 940 848 481af38f33f4dc59c30d304ce466c4f0.exe 26 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 848 481af38f33f4dc59c30d304ce466c4f0.exe 848 481af38f33f4dc59c30d304ce466c4f0.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 848 481af38f33f4dc59c30d304ce466c4f0.exe Token: SeDebugPrivilege 940 AddInProcess32.exe Token: SeShutdownPrivilege 940 AddInProcess32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 940 AddInProcess32.exe 940 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 848 wrote to memory of 940 848 481af38f33f4dc59c30d304ce466c4f0.exe 26 PID 848 wrote to memory of 940 848 481af38f33f4dc59c30d304ce466c4f0.exe 26 PID 848 wrote to memory of 940 848 481af38f33f4dc59c30d304ce466c4f0.exe 26 PID 848 wrote to memory of 940 848 481af38f33f4dc59c30d304ce466c4f0.exe 26 PID 848 wrote to memory of 940 848 481af38f33f4dc59c30d304ce466c4f0.exe 26 PID 848 wrote to memory of 940 848 481af38f33f4dc59c30d304ce466c4f0.exe 26 PID 848 wrote to memory of 940 848 481af38f33f4dc59c30d304ce466c4f0.exe 26 PID 848 wrote to memory of 940 848 481af38f33f4dc59c30d304ce466c4f0.exe 26 PID 848 wrote to memory of 940 848 481af38f33f4dc59c30d304ce466c4f0.exe 26 PID 848 wrote to memory of 940 848 481af38f33f4dc59c30d304ce466c4f0.exe 26 PID 848 wrote to memory of 940 848 481af38f33f4dc59c30d304ce466c4f0.exe 26 PID 848 wrote to memory of 940 848 481af38f33f4dc59c30d304ce466c4f0.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\481af38f33f4dc59c30d304ce466c4f0.exe"C:\Users\Admin\AppData\Local\Temp\481af38f33f4dc59c30d304ce466c4f0.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:940
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
Filesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
Filesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39