Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
04-10-2023 07:01
General
-
Target
download (1).exe
-
Size
1.4MB
-
MD5
724ca9a00c8266522af8922f2449d511
-
SHA1
89855de33e0e3ceb5a1c75de82e7480670da59c2
-
SHA256
10043243d95cc27b223c3d6a669346a3994f7b5b5a1530fb6b8d4c98b94e9fe1
-
SHA512
40eebf2b0d22ecdf40e3ee54ce243bf7501488f8098dc1185823d95a41388f55232aaf86400256dd3b3fa245221fc3b233813a33697dc7c6c0e2ccd52952de6f
-
SSDEEP
24576:andRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzDVc6vdtF:cXDFBU2iIBb0xY/6sUYYKVlV/
Score
10/10
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
bitrat9300.duckdns.org:9300
Attributes
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\download (1).exe"C:\Users\Admin\AppData\Local\Temp\download (1).exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB