Analysis
-
max time kernel
30s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-01-2023 11:42
Static task
static1
Behavioral task
behavioral1
Sample
BitRat Cracked.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral2
Sample
BitShitBuilder.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
data/modules/hvnc.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral4
Sample
data/tor/tor.exe
Resource
win10v2004-20221111-en
General
-
Target
BitShitBuilder.exe
-
Size
10.5MB
-
MD5
6b52d094d85c112904e314bc3b939542
-
SHA1
f97dab5fd7327ecb32eabb294653c29decdcb6a5
-
SHA256
1e982fc30c7a64c12d18cc2d13a25085e9c8ee0fab379665c6d011539179a76f
-
SHA512
76d353d46c75b579e62073bc330a89b4356967006781bc78c39a6ed87fd28007454e7f2c58bae6532ca4419cce9f8230e577234fc35251527dffa1c330f291b8
-
SSDEEP
196608:snxz4b91Lxr++yat8a2ZhcR+1Fm9FN38V6eBJBwkZuK:Yp4bkat8aghcR+1FgFp8pDHj
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
BitShitBuilder.exepid process 1332 BitShitBuilder.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
Processes:
BitShitBuilder.exepid process 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe 1332 BitShitBuilder.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
BitShitBuilder.exepid process 1332 BitShitBuilder.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5c19f45e83944fcff90de29d67816623d
SHA1b4896c417038915fcece58b0953e9163c38f9e56
SHA256f1514d58c431a3f1a0f8e19fca9aceb3ffac6c74a56d788dc30ba5f5ecb01b07
SHA512ed31dddff225eee8953abbe785a9d9b3e5ba2ab2526da9144b07d05c715cfe51e5a14d8dc644cd9aed49a246b9e3a1bb9e52f7d9c66d23cd6979c687b187c3e4