Overview

overview

10

Static

static

d2dce3308f...45.exe

windows7-x64

10

d2dce3308f...45.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30-11-2022 15:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

  • Size

    2.8MB

  • MD5

    ed1ececd2601553016326499250995a5

  • SHA1

    790ee4b36607be69497dc140128fef7e168041db

  • SHA256

    d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245

  • SHA512

    1e3d86795f1fbcdc5dc730ab83764a7af294a97421901c53966e8b4224e3654c36fe59d7260108702edcef60b4801c0479a1e09d3272a8688ad3798fee21f514

  • SSDEEP

    49152:WM60nwd3bfu7Kd/Qdt1kynoAYfjCAy5+245hDQESYp6O13c1teWvs1WxN:WWw47Ckt1kyoAweAy5+2uh7Jl3kq

Score
10/10
bitratpersistencetrojan

Malware Config

Extracted

Family

bitrat

Version

1.34

C2

connection.accesscam.org:1234

Attributes
  • communication_password

    725fbb843778ec4d2362b23f11e5d956

  • install_dir

    Audios

  • install_file

    SmartAudio.exe

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: RenamesItself 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
    "C:\Users\Admin\AppData\Local\Temp\d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Users\Admin\AppData\Local\Temp\d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
      "C:\Users\Admin\AppData\Local\Temp\d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1000

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1000-58-0x0000000000689A84-mapping.dmp

    Download

  • memory/1000-61-0x0000000000400000-0x00000000007CD000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/1000-62-0x0000000000400000-0x00000000007CD000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/1792-56-0x0000000076321000-0x0000000076323000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1792-57-0x0000000000310000-0x0000000000318000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1792-59-0x0000000000310000-0x0000000000318000-memory.dmp

    Filesize

    32KB

    Download