Analysis
-
max time kernel
65s -
max time network
67s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
28-09-2022 21:17
General
-
Target
CYFXHBF.exe
-
Size
1.4MB
-
MD5
cd8b3a29d0d7ef90d4110e5db4f1ab31
-
SHA1
24a001db4ba57bc94daf903299536a9ce0263bad
-
SHA256
6d84e678810bd95fca73f9ca132b8f8748da8440a45a33bd8923ffe10d26eadb
-
SHA512
87a0a7e26a64d27d56343bb033707b9936e2330b043da9ba8914c5e2f9945047c322cdcc181ba55144e802f69f328abaa9ef612acd0cecb5154d2c92c98c4a1d
-
SSDEEP
24576:7ndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzxcy9uuk2Nvv:zXDFBU2iIBb0xY/6sUYYk9nhxv
Score
10/10
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
storage.nsupdate.info:8973
Attributes
-
communication_password
bf771c9d082071fe80b18bb678220682
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CYFXHBF.exe"C:\Users\Admin\AppData\Local\Temp\CYFXHBF.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4400-132-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4400-133-0x0000000074660000-0x0000000074699000-memory.dmpFilesize
228KB
-
memory/4400-134-0x00000000749E0000-0x0000000074A19000-memory.dmpFilesize
228KB
-
memory/4400-135-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB