Analysis
-
max time kernel
180s -
max time network
202s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
30-11-2022 17:49
General
-
Target
391a0926a39689253c6363a4138d05b6160e73032c97c4b9d6ed63ed8d1530ab.exe
-
Size
5.9MB
-
MD5
4b8fd05f24e7dd6a8c77decf26006818
-
SHA1
756afe0c25d5bed2e17ab459fa86f6d78ed01cc2
-
SHA256
391a0926a39689253c6363a4138d05b6160e73032c97c4b9d6ed63ed8d1530ab
-
SHA512
45c544268e98cdcaa576617e7e6d39132b2836564c43721478b0b79708057b98fa3c67c5c2c95f19eafd12e14c9cba1b4d50442120e27fb7a1f63e2029357c4f
-
SSDEEP
98304:eVjLh6fL15rloC3QUTb3oaurBOxaY6qZNeyRb+VXukHnq6HOTUkAtnvOkNj++:7DX3QUv7uYIY6qpRbQHH9APAJOqj++
Score
10/10
Malware Config
Extracted
Family
bitrat
Version
1.32
C2
178.159.39.203:5552
Attributes
-
communication_password
e48e13207341b6bffb7fb1622282247b
-
install_dir
driversmgr
-
install_file
servicemgrdriver.exe
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 22 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\391a0926a39689253c6363a4138d05b6160e73032c97c4b9d6ed63ed8d1530ab.exe"C:\Users\Admin\AppData\Local\Temp\391a0926a39689253c6363a4138d05b6160e73032c97c4b9d6ed63ed8d1530ab.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.8MB
-
Filesize
11.8MB
-
Filesize
11.8MB
-
Filesize
8KB