Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
10/05/2022, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
481af38f33f4dc59c30d304ce466c4f0.exe
Resource
win7-20220414-en
General
-
Target
481af38f33f4dc59c30d304ce466c4f0.exe
-
Size
6.1MB
-
MD5
481af38f33f4dc59c30d304ce466c4f0
-
SHA1
ff0760bff63c33a71c93c84542402e8501d00627
-
SHA256
39b2d2d422f4f87347f8b91009544a91115af8203fdb0afa7bf7f57cdec531e7
-
SHA512
8225330df7a6f466ac9946e83cf1c50dde54cf4e330e8a1136a4837112766b3dc459ff6a6202e419e56f876986ae7549b889e8a85cbccefe6ec57dc1e7cd688e
Malware Config
Extracted
bitrat
1.38
https.myvnc.com:9111
-
communication_password
c4ca4238a0b923820dcc509a6f75849b
-
tor_process
tor
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Executes dropped EXE 1 IoCs
pid Process 2420 AddInProcess32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2420 AddInProcess32.exe 2420 AddInProcess32.exe 2420 AddInProcess32.exe 2420 AddInProcess32.exe 2420 AddInProcess32.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4260 set thread context of 2420 4260 481af38f33f4dc59c30d304ce466c4f0.exe 91 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4260 481af38f33f4dc59c30d304ce466c4f0.exe 4260 481af38f33f4dc59c30d304ce466c4f0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4260 481af38f33f4dc59c30d304ce466c4f0.exe Token: SeShutdownPrivilege 2420 AddInProcess32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2420 AddInProcess32.exe 2420 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4260 wrote to memory of 2420 4260 481af38f33f4dc59c30d304ce466c4f0.exe 91 PID 4260 wrote to memory of 2420 4260 481af38f33f4dc59c30d304ce466c4f0.exe 91 PID 4260 wrote to memory of 2420 4260 481af38f33f4dc59c30d304ce466c4f0.exe 91 PID 4260 wrote to memory of 2420 4260 481af38f33f4dc59c30d304ce466c4f0.exe 91 PID 4260 wrote to memory of 2420 4260 481af38f33f4dc59c30d304ce466c4f0.exe 91 PID 4260 wrote to memory of 2420 4260 481af38f33f4dc59c30d304ce466c4f0.exe 91 PID 4260 wrote to memory of 2420 4260 481af38f33f4dc59c30d304ce466c4f0.exe 91 PID 4260 wrote to memory of 2420 4260 481af38f33f4dc59c30d304ce466c4f0.exe 91 PID 4260 wrote to memory of 2420 4260 481af38f33f4dc59c30d304ce466c4f0.exe 91 PID 4260 wrote to memory of 2420 4260 481af38f33f4dc59c30d304ce466c4f0.exe 91 PID 4260 wrote to memory of 2420 4260 481af38f33f4dc59c30d304ce466c4f0.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\481af38f33f4dc59c30d304ce466c4f0.exe"C:\Users\Admin\AppData\Local\Temp\481af38f33f4dc59c30d304ce466c4f0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2420
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:4680
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
Filesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579