Malware Analysis Report

2025-01-03 05:16

Sample ID 230127-qjv64sbc59
Target 55ee7efcb3d1d2e0eac0ecadd651d6a299de82d94347ef9862bc981ae619532b_payload.bin
SHA256 eb3d3f3467ad0d3c84df547a2afb307c0673dd990fa84f543cd26e489614c2ce
Tags
upx bitrat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eb3d3f3467ad0d3c84df547a2afb307c0673dd990fa84f543cd26e489614c2ce

Threat Level: Known bad

The file 55ee7efcb3d1d2e0eac0ecadd651d6a299de82d94347ef9862bc981ae619532b_payload.bin was found to be: Known bad.

Malicious Activity Summary

upx bitrat trojan

BitRAT

UPX packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-01-27 13:17

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-01-27 13:17

Reported

2023-01-27 13:20

Platform

win7-20220901-en

Max time kernel

147s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\55ee7efcb3d1d2e0eac0ecadd651d6a299de82d94347ef9862bc981ae619532b_payload.exe"

Signatures

BitRAT

trojan bitrat

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\55ee7efcb3d1d2e0eac0ecadd651d6a299de82d94347ef9862bc981ae619532b_payload.exe

"C:\Users\Admin\AppData\Local\Temp\55ee7efcb3d1d2e0eac0ecadd651d6a299de82d94347ef9862bc981ae619532b_payload.exe"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 celesperial.ddns.net udp
N/A 209.127.19.155:5200 celesperial.ddns.net tcp
N/A 8.8.8.8:53 api.telegram.org udp
N/A 149.154.167.220:443 api.telegram.org tcp
N/A 149.154.167.220:443 api.telegram.org tcp
N/A 149.154.167.220:443 api.telegram.org tcp
N/A 149.154.167.220:443 api.telegram.org tcp
N/A 8.8.8.8:53 celesperial.ddns.net udp
N/A 8.8.8.8:53 celesperial.ddns.net udp

Files

memory/820-54-0x00000000762E1000-0x00000000762E3000-memory.dmp

memory/820-55-0x0000000000400000-0x00000000007EA000-memory.dmp

memory/820-56-0x0000000000230000-0x000000000023A000-memory.dmp

memory/820-57-0x0000000000230000-0x000000000023A000-memory.dmp

memory/820-58-0x0000000000400000-0x00000000007EA000-memory.dmp

memory/820-59-0x0000000000230000-0x000000000023A000-memory.dmp

memory/820-60-0x0000000000230000-0x000000000023A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-01-27 13:17

Reported

2023-01-27 13:20

Platform

win10v2004-20221111-en

Max time kernel

147s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\55ee7efcb3d1d2e0eac0ecadd651d6a299de82d94347ef9862bc981ae619532b_payload.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\55ee7efcb3d1d2e0eac0ecadd651d6a299de82d94347ef9862bc981ae619532b_payload.exe

"C:\Users\Admin\AppData\Local\Temp\55ee7efcb3d1d2e0eac0ecadd651d6a299de82d94347ef9862bc981ae619532b_payload.exe"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 celesperial.ddns.net udp
N/A 209.127.19.155:5200 celesperial.ddns.net tcp
N/A 8.8.8.8:53 api.telegram.org udp
N/A 149.154.167.220:443 api.telegram.org tcp
N/A 20.189.173.15:443 tcp
N/A 178.79.208.1:80 tcp
N/A 178.79.208.1:80 tcp
N/A 178.79.208.1:80 tcp
N/A 8.8.8.8:53 celesperial.ddns.net udp
N/A 204.79.197.200:443 tcp
N/A 84.53.175.121:80 tcp
N/A 8.8.8.8:53 celesperial.ddns.net udp
N/A 8.8.8.8:53 celesperial.ddns.net udp

Files

memory/2700-132-0x0000000000400000-0x00000000007EA000-memory.dmp

memory/2700-133-0x0000000074340000-0x0000000074379000-memory.dmp

memory/2700-134-0x00000000746C0000-0x00000000746F9000-memory.dmp

memory/2700-135-0x0000000000400000-0x00000000007EA000-memory.dmp

memory/2700-136-0x0000000074340000-0x0000000074379000-memory.dmp

memory/2700-137-0x00000000746C0000-0x00000000746F9000-memory.dmp