Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
27-01-2023 13:17
General
-
Target
55ee7efcb3d1d2e0eac0ecadd651d6a299de82d94347ef9862bc981ae619532b_payload.exe
-
Size
2.0MB
-
MD5
63cf067ef62b81cdfbe145c30ae6bd58
-
SHA1
5ab59a6bedc7b58d24b6fc433c7c12e868c34d27
-
SHA256
eb3d3f3467ad0d3c84df547a2afb307c0673dd990fa84f543cd26e489614c2ce
-
SHA512
a8423060461f12fcc14307d26e7abcb41d260c8e0fe31deee38ee21ee102a8d7451a255d8100d0ead2f4df6eb85851937f9b4d02a3ddecb6f028058934e605e2
-
SSDEEP
24576:KndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzLCthXu2M:sXDFBU2iIBb0xY/6sUYYECtttM
Score
10/10
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
celesperial.ddns.net:5200
Attributes
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55ee7efcb3d1d2e0eac0ecadd651d6a299de82d94347ef9862bc981ae619532b_payload.exe"C:\Users\Admin\AppData\Local\Temp\55ee7efcb3d1d2e0eac0ecadd651d6a299de82d94347ef9862bc981ae619532b_payload.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
3.9MB
-
Filesize
228KB
-
Filesize
228KB