Analysis
-
max time kernel
24s -
max time network
30s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
21-03-2023 14:25
General
-
Target
555.exe
-
Size
1.4MB
-
MD5
be3a6f123744a0e766dac337f69b4db1
-
SHA1
2f1ab8ebeb853aa6696bfd50df6c360d7709bf96
-
SHA256
3b5d3ee4924007c9d14360ff437c61288195d348c3f876e25629fd6aa9c5c9c0
-
SHA512
73de60dcc105008e4b7937540433f442a4a073f481707dc19e42cab3362dd2a4792dfb7fd4451be32910851a644b24fcc85742d2f0f50bbd9951f4c7f34aa33f
-
SSDEEP
24576:DndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzh1fylB:LXDFBU2iIBb0xY/6sUYY8C
Score
10/10
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
220.247.167.232:5000
Attributes
-
communication_password
827ccb0eea8a706c4c34a16891f84e7b
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\555.exe"C:\Users\Admin\AppData\Local\Temp\555.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
3.9MB
-
Filesize
3.9MB