Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-09-2023 16:35

General

  • Target

    boolhongupdater0.1_JC.exe

  • Size

    6.2MB

  • MD5

    48b417f79606cc9033410227d375b006

  • SHA1

    fce9ce20523634aa4d9fe093dc6a21d5eefb2218

  • SHA256

    17d989ad32bf3b1056b79321c2e35d2fc812e26e05e5ab661bf8eaa256aa6cd8

  • SHA512

    8aede261d387d3434f6fbf9309e236bc8ca5ab2e8a722a60c4c3cc820ce50c88a4e7d86e8ccb1dde469715a1ae800e8dfe57d5a47c1c2e7d445ba9a913393589

  • SSDEEP

    24576:JCXRJTV2FJkhL5rR5e7Yjuif3f+hZtbow3yDLLrzCh0Jr0PoOvMmwHTeReqIMmOW:cloPHps

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

rornfl12.duckdns.org:3072

Attributes
  • communication_password

    81dc9bdb52d04dc20036dbd8313ed055

  • install_dir

    chrome

  • install_file

    updater

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\boolhongupdater0.1_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\boolhongupdater0.1_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4824
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
        PID:3404
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        2⤵
          PID:1216
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
          2⤵
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4804
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
          2⤵
            PID:2280

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4804-1334-0x0000000000400000-0x00000000007CE000-memory.dmp

          Filesize

          3.8MB

        • memory/4804-1381-0x0000000074560000-0x0000000074599000-memory.dmp

          Filesize

          228KB

        • memory/4804-1350-0x0000000000400000-0x00000000007CE000-memory.dmp

          Filesize

          3.8MB

        • memory/4804-1344-0x0000000074560000-0x0000000074599000-memory.dmp

          Filesize

          228KB

        • memory/4804-1336-0x00000000748A0000-0x00000000748D9000-memory.dmp

          Filesize

          228KB

        • memory/4824-40-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-48-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-10-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-12-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-14-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-16-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-18-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-20-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-22-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-24-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-26-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-28-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-30-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-32-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-34-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-36-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-38-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-0-0x0000000074990000-0x0000000075140000-memory.dmp

          Filesize

          7.7MB

        • memory/4824-42-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-44-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-46-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-8-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-50-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-52-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-54-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-56-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-58-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-60-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-62-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-64-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-66-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-399-0x0000000074990000-0x0000000075140000-memory.dmp

          Filesize

          7.7MB

        • memory/4824-526-0x0000000005890000-0x00000000058A0000-memory.dmp

          Filesize

          64KB

        • memory/4824-1327-0x0000000003100000-0x0000000003101000-memory.dmp

          Filesize

          4KB

        • memory/4824-1328-0x00000000087A0000-0x0000000008D44000-memory.dmp

          Filesize

          5.6MB

        • memory/4824-1333-0x0000000074990000-0x0000000075140000-memory.dmp

          Filesize

          7.7MB

        • memory/4824-6-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-4-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-3-0x00000000069D0000-0x0000000006C5C000-memory.dmp

          Filesize

          2.5MB

        • memory/4824-2-0x0000000005890000-0x00000000058A0000-memory.dmp

          Filesize

          64KB

        • memory/4824-1-0x00000000007E0000-0x0000000000E14000-memory.dmp

          Filesize

          6.2MB