Analysis
-
max time kernel
0s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
22-12-2023 02:32
General
-
Target
53745f92c92fa25185d37c1093968360.exe
-
Size
2.2MB
-
MD5
53745f92c92fa25185d37c1093968360
-
SHA1
28a7682119192de103b6ec18f523109251e33f61
-
SHA256
555628994979ebb5381854d7d51b8378d12905a5f99d8efaf07e93eb56720eea
-
SHA512
da33bfef625496b697850b42a8d516bccaadbea833570fcee117a595651b670ae60f3dbd758bc37a258db46739aa0c789e8b0e7a0b9370c68f66c7766a2bfd5a
-
SSDEEP
49152:YisAGUB6z+YmVa9Ehv9k2dPk2Vr/u0HM9vBiahGKwKPT6:mNUB6z+pVIWv9NdM2Vr2KMjFhP5T
Malware Config
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\53745f92c92fa25185d37c1093968360.exe"C:\Users\Admin\AppData\Local\Temp\53745f92c92fa25185d37c1093968360.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Mjhbgvlj.vbs"2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Local\Adobe\FlashPlayer.exe'1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD5560699f8ae8ba5d8210322f2aa3d68e9
SHA15752bbad7e925923c8b152b933d921e57e549b6b
SHA25600f4b9e4529702175766c5ccd38ec737bf38b367268bd4ebdf7f9c66045eee0c
SHA512bcfd5602d81b7a60163c7fcd3301ac2d85b8e8ca5f10f600c44dd1b792be8539bb9a05ed496fc930ee18a6439ceb5f4193fd3ad48f1a25cd23338b889900e1c0
-
Filesize
17KB
MD5247592816a6cd7fdfa79729322b77f80
SHA15ecc2989061e655e7a791901d8cf5490205acb3c
SHA256da21060f666639b64e674e32608c40d22a5d8bc849a17d45dac6eb47be44e513
SHA512859232558c8c6daf2c922d9cb8ddc5bd443d3d502706eaf08a6d12694d6533c696cc39596ed187bc2c7c22d9fe90406201f1fa0d07b8cb1f432863f621956d4e
-
Filesize
145B
MD50e442b7c7f432b800d1aa3ac1bf9aeda
SHA14738a1f8c05564def091e6767b12c39a7d31fcfd
SHA2562025a2c9a96307a19cd7dabbc9561581e502b59b11d6b94de6baa74b654d78bd
SHA512c7dcadb84ebc5a8ee034d9b7287435e3f2d3b88f5d07d89abdfee84e6aacd7f1b0d0d6ba4a8cb362e5438b30c4c60da8dbb6e7586f3472e0ce6b682fc2ddaa37
-
Filesize
7KB
MD5b7cd0589f2d07107a28cf8756cc519c1
SHA1fe429cdcd3bd031715c0f9541a823020b575feb7
SHA2564a0fd7d12332a215cadf5b51eac295a03525366124e3b7aff2effdbd16d3d9ca
SHA5129bd2789c36cb107d516799f7fe01ceae98218e21951d92a7b880d3872e6e46d59a4ccc55b8f898ac3702ce659e94daefd7261d5429c55eb72e535f899774e193
-
Filesize
1KB
MD51ec253da4a4a12d099226f6607583ec5
SHA1402030020d2379d99fabdd3a7d4d0715752116e2
SHA256d52dfe010f09f853ab54f66bd99a0fd406498190787539963e7153d4ef923d4e
SHA5121b51418d79bc31d011532429da55b1d54bd302dbf71adef16eb249baae0e47d65fd5e961374cbf1d6eed763bf67e7ca23c52d1594a0db8f344ee5a44721c61bc
-
Filesize
44KB
MD5b7b2a3757584a039cfe2d64e7cb0c204
SHA17f3287d90496200d71fdf8e69fb065539f33c7f2
SHA256897ecf77f89c0b505bb251260761d7053730af37bc7e6c4d636d7e118cafacf7
SHA5128c637f8d019beb9dcc0f0384ef161f4ee06cc206b3e3b2e43c6c3847828d5c863f77f9389877c6fbad8bb1ff28ae185f11397cf11f0063979c073c13eee07a5f
-
Filesize
2KB
MD53e3c0ef7a8b70ca292c4c614896e833f
SHA14f6016ec82068254e209daab7abf686dc81878c9
SHA256ef9f510b96f336be25780b36a39995a06d599e1ce4b544a4c9e6460ac2c52cf5
SHA512b293640fa9dd943b25e3e4cbc4999e2f9e8b9b26cf57052af63e39a5d24e8f56a255f176b591828e7ab4fc195203a89b3c29ebbe9cc179d166432a24dfef059a
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.2MB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
176KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
6.9MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
6.9MB
-
Filesize
2.0MB
-
Filesize
256KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB