Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    01-09-2023 16:21

General

  • Target

    Updaters_JC.exe

  • Size

    2.8MB

  • MD5

    7a1a59c9db320a777d4512983ddce650

  • SHA1

    e5b17572b94dfc87b686da2aa6ad0d6b8823fe97

  • SHA256

    cc7bf8c734a4146942f8f754ab55e257a8be68f5c687c3bcc9fcdb7a5dabf871

  • SHA512

    5631d7cebb6351d0490ac85005f6a1282b20a47e51626ba2a00f515d7e657ffe18c7f1451f6ba478a64ff7c20e8a86dc80ba0c7cdf716286e650bb021d845856

  • SSDEEP

    49152:HA4q5sXHCFtLsBbpHsTGea3n1MA7+UAOUkcqUIKXOIGYMa5:HyggRsBl/ea31/+Ufqq1GN6

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

rornfl12.duckdns.org:3072

Attributes
  • communication_password

    81dc9bdb52d04dc20036dbd8313ed055

  • install_dir

    chrome

  • install_file

    updater

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Updaters_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\Updaters_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
        PID:1804
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        2⤵
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2464

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1964-43-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-7-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-2-0x00000000050D0000-0x0000000005110000-memory.dmp

      Filesize

      256KB

    • memory/1964-3-0x0000000005F40000-0x00000000061BC000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-4-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-5-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-45-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-9-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-11-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-13-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-15-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-47-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-19-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-21-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-23-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-25-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-27-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-29-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-31-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-33-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-1-0x0000000000020000-0x00000000002FC000-memory.dmp

      Filesize

      2.9MB

    • memory/1964-37-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-39-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-41-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-35-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-0-0x0000000073FC0000-0x00000000746AE000-memory.dmp

      Filesize

      6.9MB

    • memory/1964-17-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-49-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-51-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-53-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-55-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-57-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-59-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-61-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-63-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-65-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-67-0x0000000005F40000-0x00000000061B6000-memory.dmp

      Filesize

      2.5MB

    • memory/1964-70-0x0000000073FC0000-0x00000000746AE000-memory.dmp

      Filesize

      6.9MB

    • memory/1964-166-0x00000000050D0000-0x0000000005110000-memory.dmp

      Filesize

      256KB

    • memory/1964-1082-0x0000000000650000-0x0000000000651000-memory.dmp

      Filesize

      4KB

    • memory/1964-1083-0x0000000008380000-0x0000000008576000-memory.dmp

      Filesize

      2.0MB

    • memory/1964-1084-0x0000000004F00000-0x0000000004F4C000-memory.dmp

      Filesize

      304KB

    • memory/1964-1100-0x0000000073FC0000-0x00000000746AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2464-1099-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/2464-1111-0x0000000000170000-0x000000000017A000-memory.dmp

      Filesize

      40KB

    • memory/2464-1110-0x0000000000170000-0x000000000017A000-memory.dmp

      Filesize

      40KB

    • memory/2464-1115-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/2464-1119-0x0000000000170000-0x000000000017A000-memory.dmp

      Filesize

      40KB

    • memory/2464-1120-0x0000000000170000-0x000000000017A000-memory.dmp

      Filesize

      40KB