Malware Analysis Report

2025-01-03 05:24

Sample ID 231004-htbw8ahg2v
Target download (1).exe
SHA256 10043243d95cc27b223c3d6a669346a3994f7b5b5a1530fb6b8d4c98b94e9fe1
Tags
bitrat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

10043243d95cc27b223c3d6a669346a3994f7b5b5a1530fb6b8d4c98b94e9fe1

Threat Level: Known bad

The file download (1).exe was found to be: Known bad.

Malicious Activity Summary

bitrat trojan upx

BitRAT

Bitrat family

UPX packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-10-04 07:01

Signatures

Bitrat family

bitrat

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-04 07:01

Reported

2023-10-04 07:03

Platform

win10v2004-20230915-en

Max time kernel

146s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\download (1).exe"

Signatures

BitRAT

trojan bitrat

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\download (1).exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\download (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\download (1).exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\download (1).exe

"C:\Users\Admin\AppData\Local\Temp\download (1).exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 254.109.26.67.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 bitrat9300.duckdns.org udp
RU 194.147.140.172:9300 bitrat9300.duckdns.org tcp
US 8.8.8.8:53 172.140.147.194.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 126.178.238.8.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 bitrat9300.duckdns.org udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 bitrat9300.duckdns.org udp
US 8.8.8.8:53 208.143.182.52.in-addr.arpa udp

Files

memory/2804-0-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2804-1-0x0000000074B10000-0x0000000074B49000-memory.dmp

memory/2804-2-0x0000000074E90000-0x0000000074EC9000-memory.dmp

memory/2804-3-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2804-4-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2804-5-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2804-6-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2804-7-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2804-8-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2804-9-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2804-10-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2804-11-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2804-12-0x0000000074B10000-0x0000000074B49000-memory.dmp

memory/2804-13-0x0000000074E90000-0x0000000074EC9000-memory.dmp

memory/2804-14-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2804-15-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2804-16-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2804-17-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2804-18-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2804-19-0x0000000000400000-0x00000000007E4000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-04 07:01

Reported

2023-10-04 07:03

Platform

win7-20230831-en

Max time kernel

146s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\download (1).exe"

Signatures

BitRAT

trojan bitrat

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\download (1).exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\download (1).exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\download (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\download (1).exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\download (1).exe

"C:\Users\Admin\AppData\Local\Temp\download (1).exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 bitrat9300.duckdns.org udp
RU 194.147.140.172:9300 bitrat9300.duckdns.org tcp
US 8.8.8.8:53 bitrat9300.duckdns.org udp
US 8.8.8.8:53 bitrat9300.duckdns.org udp

Files

memory/2152-0-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2152-1-0x00000000002F0000-0x00000000002FA000-memory.dmp

memory/2152-2-0x00000000002F0000-0x00000000002FA000-memory.dmp

memory/2152-3-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2152-4-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2152-5-0x00000000002F0000-0x00000000002FA000-memory.dmp

memory/2152-6-0x00000000002F0000-0x00000000002FA000-memory.dmp

memory/2152-7-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2152-8-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2152-9-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2152-10-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2152-11-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2152-12-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2152-13-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2152-14-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2152-15-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2152-16-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2152-17-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2152-18-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2152-19-0x0000000000400000-0x00000000007E4000-memory.dmp