Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    01-09-2023 05:56

General

  • Target

    Updaters.exe

  • Size

    2.8MB

  • MD5

    7a1a59c9db320a777d4512983ddce650

  • SHA1

    e5b17572b94dfc87b686da2aa6ad0d6b8823fe97

  • SHA256

    cc7bf8c734a4146942f8f754ab55e257a8be68f5c687c3bcc9fcdb7a5dabf871

  • SHA512

    5631d7cebb6351d0490ac85005f6a1282b20a47e51626ba2a00f515d7e657ffe18c7f1451f6ba478a64ff7c20e8a86dc80ba0c7cdf716286e650bb021d845856

  • SSDEEP

    49152:HA4q5sXHCFtLsBbpHsTGea3n1MA7+UAOUkcqUIKXOIGYMa5:HyggRsBl/ea31/+Ufqq1GN6

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

rornfl12.duckdns.org:3072

Attributes
  • communication_password

    81dc9bdb52d04dc20036dbd8313ed055

  • install_dir

    chrome

  • install_file

    updater

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Updaters.exe
    "C:\Users\Admin\AppData\Local\Temp\Updaters.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2280

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1632-53-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-9-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-2-0x0000000005100000-0x0000000005140000-memory.dmp

    Filesize

    256KB

  • memory/1632-3-0x0000000005E50000-0x00000000060CC000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-4-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-5-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-51-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-7-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-11-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-13-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-15-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-49-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-17-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-23-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-21-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-27-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-25-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-67-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-65-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-63-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-1-0x0000000074350000-0x0000000074A3E000-memory.dmp

    Filesize

    6.9MB

  • memory/1632-59-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-57-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-55-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-61-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-0-0x0000000001330000-0x000000000160C000-memory.dmp

    Filesize

    2.9MB

  • memory/1632-19-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-47-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-45-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-43-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-41-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-39-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-37-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-35-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-33-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-31-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-29-0x0000000005E50000-0x00000000060C6000-memory.dmp

    Filesize

    2.5MB

  • memory/1632-620-0x0000000074350000-0x0000000074A3E000-memory.dmp

    Filesize

    6.9MB

  • memory/1632-698-0x0000000005100000-0x0000000005140000-memory.dmp

    Filesize

    256KB

  • memory/1632-1082-0x00000000005D0000-0x00000000005D1000-memory.dmp

    Filesize

    4KB

  • memory/1632-1083-0x00000000081D0000-0x00000000083C6000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-1084-0x0000000000C30000-0x0000000000C7C000-memory.dmp

    Filesize

    304KB

  • memory/1632-1100-0x0000000074350000-0x0000000074A3E000-memory.dmp

    Filesize

    6.9MB

  • memory/2280-1099-0x0000000000400000-0x00000000007CE000-memory.dmp

    Filesize

    3.8MB

  • memory/2280-1110-0x00000000001B0000-0x00000000001BA000-memory.dmp

    Filesize

    40KB

  • memory/2280-1111-0x00000000001B0000-0x00000000001BA000-memory.dmp

    Filesize

    40KB

  • memory/2280-1115-0x0000000000400000-0x00000000007CE000-memory.dmp

    Filesize

    3.8MB

  • memory/2280-1119-0x00000000001B0000-0x00000000001BA000-memory.dmp

    Filesize

    40KB

  • memory/2280-1120-0x00000000001B0000-0x00000000001BA000-memory.dmp

    Filesize

    40KB