Overview

overview

10

Static

static

10

Launcher.exe

windows7_x64

10

Launcher.exe

windows10_x64

10

Analysis

  • max time kernel
    160s
  • max time network
    181s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    22-06-2022 15:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Launcher.exe

  • Size

    3.8MB

  • MD5

    523ba4342b29b679d735435562a54280

  • SHA1

    0b7661e3cdd86e6eb77a6016448810d90ec99cbd

  • SHA256

    b58321b95226031b34e9439804673533b0f16f921ec0bfb535c80b23b226a290

  • SHA512

    a813f4af3f278f7a5abf865a6e808a2f4190a1f21c5dea66cb7dd103fbbd423c5799db8beec532b85cc407d9033b788d6fad9ce52de7437d16b0bca826f6b8e7

Score
10/10
bitratsuricatatrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

bitrat9300.duckdns.org:9300

Attributes
  • communication_password

    e10adc3949ba59abbe56e057f20f883e

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1436-54-0x0000000000400000-0x00000000007CE000-memory.dmp
    Filesize

    3.8MB

    Download
  • memory/1436-55-0x0000000075191000-0x0000000075193000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1436-56-0x0000000000290000-0x000000000029A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1436-57-0x0000000000290000-0x000000000029A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1436-59-0x0000000000290000-0x000000000029A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1436-58-0x0000000000290000-0x000000000029A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1436-60-0x0000000000290000-0x000000000029A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1436-61-0x0000000000290000-0x000000000029A000-memory.dmp
    Filesize

    40KB

    Download