Overview

overview

10

Static

static

URLScan

urlscan

1

http://45.95.169.45:...

windows10-2004-x64

10

Resubmissions

22-11-2022 00:51

221122-a7gqmagg5y 8

21-11-2022 23:09

221121-25dpqsed6v 10

21-11-2022 21:54

221121-1slddace2y 10

21-11-2022 21:30

221121-1crkfsge79 10

21-11-2022 20:42

221121-zg8h4afe23 10

21-11-2022 19:29

221121-x7e85ahb6w 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    http://45.95.169.45:23205/

  • Sample

    221121-x7e85ahb6w

Score
10/10
bitratxmrigminerpersistencetrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

45.95.168.128:23202

Attributes
  • communication_password

    ed99c23d77796aac877ce1f91481dc28

  • install_dir

    Oracle

  • install_file

    java.exe

  • tor_process

    tor

Extracted

Family

bitrat

Version

1.34

C2

45.95.168.128:23202

Attributes
  • communication_password

    ed99c23d77796aac877ce1f91481dc28

  • install_dir

    test

  • install_file

    test.exe

  • tor_process

    tor

Targets

    • Target

      http://45.95.169.45:23205/

    Score
    10/10
    bitratxmrigminerpersistencetrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks