Analysis
-
max time kernel
153s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
21-03-2023 14:32
General
-
Target
bc0374c212e401d5f220df5657a980fc40fc210af0a7c34dd8d43556d8b2a4be.exe
-
Size
2.1MB
-
MD5
bf35c2910d407f1cf330f465a793dc1b
-
SHA1
306324e8b2cc82f09c7b0f56cde008337b8f5205
-
SHA256
bc0374c212e401d5f220df5657a980fc40fc210af0a7c34dd8d43556d8b2a4be
-
SHA512
6fb5fa5ab36acbcf9726426b31ec843b3f8d277047e8d1d51136a91628dd3e0d2c99e6809578ab83f0cc5bb67706462b5653ce00943c7b168d010ce7faab9094
-
SSDEEP
49152:UrpxN1w5b1QvE4mnVA93py1abMy+mUIuEMyN5KvG8aM6TyHIzkY:Ijw5K4A93paabwtIuEMyN2G8fRY
Score
10/10
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
pradeepprabhu705.hopto.org:312
Attributes
-
communication_password
827ccb0eea8a706c4c34a16891f84e7b
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc0374c212e401d5f220df5657a980fc40fc210af0a7c34dd8d43556d8b2a4be.exe"C:\Users\Admin\AppData\Local\Temp\bc0374c212e401d5f220df5657a980fc40fc210af0a7c34dd8d43556d8b2a4be.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
228KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB