Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-09-2023 05:49

General

  • Target

    tmp.exe

  • Size

    80KB

  • MD5

    f23517e5bce5fcd75d328744b2a25557

  • SHA1

    eca19b511c2afeed418ba7c58873b2173218e9cc

  • SHA256

    0a1d4a8adac7c179bda2ecee2812f34ccb924e2f841e0b3bf7d411236b556338

  • SHA512

    f29f803d3bb175ccc19835d46baa7c6da41ac4db8e882b81fab19a07ec151120777e076e1472e5674f77deb63e0bbda2ee556e2749d8177200ab21202c091e57

  • SSDEEP

    768:Q6pH7NT6n2e/t/sZk/jObkvhnWGdqOYD7lv/oB9rhly/kGRPxkMqFNUNalwe4edf:Q6lF69t/j26WGYg96hXqF20lweDh7

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

smgqnt3eixxksasu.xyz:1234

Attributes
  • communication_password

    30afda4853ef5b1bc36463ba95d84247

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3284
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      2⤵
        PID:4424
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        2⤵
          PID:4012
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
          2⤵
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1424

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1424-1057-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/1424-1103-0x0000000075390000-0x00000000753C9000-memory.dmp

        Filesize

        228KB

      • memory/1424-1070-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/1424-1059-0x0000000075010000-0x0000000075049000-memory.dmp

        Filesize

        228KB

      • memory/3284-38-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-16-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-6-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-42-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-10-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-46-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-14-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-44-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-18-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-20-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-22-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-24-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-26-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-28-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-30-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-32-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-34-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-36-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-0-0x0000000000C30000-0x0000000000C4A000-memory.dmp

        Filesize

        104KB

      • memory/3284-40-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-8-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-5-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-12-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-48-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-50-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-52-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-54-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-56-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-58-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-60-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-62-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-64-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-66-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-68-0x00000000068D0000-0x0000000006B40000-memory.dmp

        Filesize

        2.4MB

      • memory/3284-1049-0x0000000006070000-0x0000000006071000-memory.dmp

        Filesize

        4KB

      • memory/3284-1050-0x00000000084C0000-0x0000000008A64000-memory.dmp

        Filesize

        5.6MB

      • memory/3284-1055-0x0000000075100000-0x00000000758B0000-memory.dmp

        Filesize

        7.7MB

      • memory/3284-4-0x00000000055E0000-0x00000000055F0000-memory.dmp

        Filesize

        64KB

      • memory/3284-3-0x0000000075100000-0x00000000758B0000-memory.dmp

        Filesize

        7.7MB

      • memory/3284-2-0x00000000055E0000-0x00000000055F0000-memory.dmp

        Filesize

        64KB

      • memory/3284-1-0x0000000075100000-0x00000000758B0000-memory.dmp

        Filesize

        7.7MB