Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
09-06-2022 15:31
General
-
Target
rIAkfAFfjn.exe
-
Size
1.4MB
-
MD5
724ca9a00c8266522af8922f2449d511
-
SHA1
89855de33e0e3ceb5a1c75de82e7480670da59c2
-
SHA256
10043243d95cc27b223c3d6a669346a3994f7b5b5a1530fb6b8d4c98b94e9fe1
-
SHA512
40eebf2b0d22ecdf40e3ee54ce243bf7501488f8098dc1185823d95a41388f55232aaf86400256dd3b3fa245221fc3b233813a33697dc7c6c0e2ccd52952de6f
Score
10/10
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
bitrat9300.duckdns.org:9300
Attributes
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rIAkfAFfjn.exe"C:\Users\Admin\AppData\Local\Temp\rIAkfAFfjn.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/960-54-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/960-55-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/960-56-0x0000000000270000-0x000000000027A000-memory.dmpFilesize
40KB
-
memory/960-57-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/960-58-0x0000000000270000-0x000000000027A000-memory.dmpFilesize
40KB