Analysis
-
max time kernel
78s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
22-12-2023 03:31
General
-
Target
5b8fb7d7a2593534a55488146dc93f43.exe
-
Size
7.6MB
-
MD5
5b8fb7d7a2593534a55488146dc93f43
-
SHA1
7b4c89ed2038f106d109a68cd8bf6ae9f8adfd16
-
SHA256
29c7a3ada8baf686277bc18e5cadf37083b76aa56e5ab0f279fc7d13fdbdc062
-
SHA512
c1985985f7832fc21e335799150f11a92699356bd31b6980f6192140df4f888221f99ea3e7ff1ee5adb7fd5a7feb2ca12eef32c14d08aca314b46206a9181446
-
SSDEEP
196608:zYTeu2ZxHNDxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOfTV73c:UTeuIPxwZ6v1CPwDv3uFteg2EeJUO9Wq
Malware Config
Extracted
bitrat
1.30
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
BitRAT payload 2 IoCs
-
ACProtect 1.3x - 1.4x DLL software 12 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
UPX packed file 39 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: RenamesItself 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b8fb7d7a2593534a55488146dc93f43.exe"C:\Users\Admin\AppData\Local\Temp\5b8fb7d7a2593534a55488146dc93f43.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\230c72a1\tor\java.exe"C:\Users\Admin\AppData\Local\230c72a1\tor\java.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344B
MD5a369d7452300a59243505688341ab8f0
SHA172bf2cb6b1f57f15556db8305e9e8615054b75f6
SHA2566dba9b2e1af9743119b5d18cd91d38ac8ca6da78d8cd0360031908d60f5041d7
SHA5122c75f89e8ac11c9053ade9bcf38078213a4f2747d911afd41050e47f06416ccef21d43d94dfa2d98d8161e291fa8856a3e3c6f5cb61d31309c5c85cd46667ca8
-
Filesize
77KB
MD51ce6cca45249bd963413c5e97cb71eba
SHA1b575eb10e1fb8f9868eb60f4c4cf07ee93348eca
SHA256dcd43b59a549ca3770d0adb11b5b51f151dca590e2389a50be96347ae23cba8c
SHA512c04273e38a84a8f29f29195c276e59a9e28cecf6041b2ed0759424280624b4a09ab246f1f31c84d8e38bf04a7681a0b771eaf403387f4873af2a9c5a8499fa37
-
Filesize
69KB
MD57332ae1b5ef2948e06d7dd74e34d285a
SHA18149801930c53571e07b3643ba72062380bf09fc
SHA256be34f71f8ece90a778ac3ac1e850d30ffa1b1b1ca44ede41cdab116c13a31ea7
SHA5127c0a1f1e81280a43aadbcff99f377cf2248ee7527c1930343d3d0057a1f32d9a49faff05a8a4ae86d3a48684145f32c4279fc407552f6cb71b064c2a8f716c6f
-
Filesize
84KB
MD5895c478a8dbb34a908daea69b68ffb82
SHA1751db6100bb13e724c752a2bf4592d922e4e2eac
SHA256d68d6fb04ec6339a4fe30ea78eec471adafcdaf7cac86b9fb731c8f1a032414a
SHA5127c501194002271816af2ab0521813c4fc06afde9ca3aaee70749e5fcfc755745ced6f05da61ba2878566ef2b6c085627cd19f6985d3d87c93366b93064dc3d44
-
Filesize
133KB
MD593695e9afd4fc45248beee4eeb5c9a0c
SHA19f325960fbb7ba9cfd6556c7b1faf1e915620e6c
SHA25649de78374978daa22f0180ae9c1dd81588205b070b8001b8846a529920f78e83
SHA512d81a6fa6845b49382d3f266f425926507fe3a9864b2e70d3ace119bbb9d17031710d539a7deeca7b299711d0a4602ff2f7253be7915b1fb603ade6c5a6f0542f
-
Filesize
155KB
MD5a97d8636811ba355290c8689fd9b0c16
SHA1d2691f011f1960443e2f1d05908463314f86b62a
SHA2561f5c6f931fb918405f1dbe840357b8198701231ebd03e69bf90e6d7df057f9c4
SHA512a41881c955406ece7d3d0650b986ddf988e2baaff02a95e0223f293b12cc797da0557e80c9dd526bf64c4ac8bc3bee3e32843977f8d084fa10c93e942517e7a5
-
Filesize
141KB
MD5fcc783c62f5c5812c6b3ecd2b942afdb
SHA11fc90c879cc25de07650dc069cc7eff6748ba88a
SHA2568c39be3118b3ae076223df2bc38df464d8e1d9f31e2e7f9f297d54d90b5e751f
SHA512073c3f03b9e6da09ce2325b24d9131f2fe7a0af49c7d5658dd9f1ce36fbd8e51f40f742624c54a496c74b48362ccb8376c01834eeca12974ba1d7c91090bddef
-
Filesize
206KB
MD54eb8b07d42508902d224a7464ccf6e7a
SHA1f6fb33ecba0ac3d0ed02c6a6a849eeff1329d971
SHA256d1ede39599d9359f3368d6022de0ca2d5698f4f34f67f426fb16224ee83271c7
SHA512a4d4bce19497f553c2daf7055bc9ccf52b0ea8684f7b935535c431ad5e4304caa0bf3545e23d398cce8d47a2db7f10ec37729354fb863bf5608542a71eaeb40c
-
Filesize
165KB
MD5498d9e2d0d08097f94dadfab295f3663
SHA15e7a860803358eb2cf96f1d8df01799a2f19a968
SHA256ce3d9899d4b6257371a89086138a0d19b5a7174e6584cd46697ea78e010d4009
SHA51254e678e6a75675fe2f8fd5b140cfd6b87efa0b418871e4e2ab7f72255b767cc2fb343b92bd9efabf761d8e65790f71780dc8e18faa6aa8cf4b5bf3489bf7fbe6
-
Filesize
148KB
MD540643aae78381bec1ee1b333afabf38e
SHA1723cc690784e831383603781fcae32c4d89f3741
SHA25600b4829e84ee723c88d7612304ce11fdf97babf58c7c197a1b9b496358497bbb
SHA512550ba102d0082533d757099039c4f17aa9ce573e05d40eb9c07e984278760dd19a4a934d5aa20b4aa2ad8105edae951b9b527675c4ef62e14033882636416174
-
Filesize
139B
MD531cc422ce83cab0acfc091f41a59fc42
SHA1ee55b2b4f0e0946b6b5be5ef75543f6fae7b7569
SHA256c77372e430efec15bb22ccb84345e23a9203bda0dc730504820a32b3528a21ba
SHA512da0f9b3e897773a2d8c96da3ff2dec2ab91c6e58913539bf5948c0919aa77dec899f3984c51323f8cb08cf63d7b8dc5491fb5816ddd1bd666d0577e14daabbb9
-
Filesize
52KB
MD5add33041af894b67fe34e1dc819b7eb6
SHA16db46eb021855a587c95479422adcc774a272eeb
SHA2568688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
136KB
MD561b7682e703377c60d2522d8472ec424
SHA1205fa2191042f4986eb7d2d930d81070f4777a05
SHA2568068db10134871dd7f3fc5fff4638410a902bad7822622eeb933dd7e70dc80b7
SHA51216ad4bfa04927d716b9f64938966c803da8599694c2b0304d34cf57fea4eec03004ca60929930879879f012a73ffed89f7c7f181bb2ce9ed0db3988af00b4ec4
-
Filesize
968KB
MD54f308ebe0bb2db79ed0c58d4ca07df0c
SHA18586dce73d2a817166296e382ea786b7f4a3eb03
SHA256457e56b516429ae421291e61a4af923397707b78989eb3385427d84f9abac71a
SHA51245f8913fe589f7bdf330bed78727267db8d3720fbd08e37473a2532ef71794d5349314fa058f3b6f3e886ffa731c7b4b3454c9cc6374145bd62a22521a8e500e
-
Filesize
83KB
MD53c257f4983c895d8e5be081c1766e24b
SHA1d7b643c2bc59c437baf1ddb05cddfed2e60a0d09
SHA25611e879171517c9d96de411d82b3d2b373187f329d0fe54e08e5126e01e8090f1
SHA5123f6463eaa39b8031fd5891164380644cd0c765d22c9f43c3abab3023466199fa23c253a90cec28023c6fd8dd06da57cb784eb9b061b1c1ccab70b99ad4f2d209
-
Filesize
131KB
MD53e393be7c6dc8f46d5767dbac0790f81
SHA1d8d199794af5ab1c9902ccfa668c5674c9399ed0
SHA2565ccce2592ec97156a5b595ea75cb7ab74124d748c29bcda8aaa1cbaa7052fa2d
SHA512072f520322047e737a960940df1a13b91d0277063a1b40d715e489c72cb59f5e341189deb21b4ed7bc2b1f5eb1f206ba1476af6a74cbe06599e9f1a58255f6f0
-
Filesize
113KB
MD50e1d0a5c93913861d1bd2b816e93ea28
SHA1ef3a58fe453978b381c69a8e4f58bd3d1082302a
SHA256eff04daf3c3c7d2df935581761e5f9945eecd617fcf2c68ffe8428471865971b
SHA512f021b37b3e4b4c11094394ee75b33292413ae2808bb6d427507e768ed1bb25e30b5446d38112f3fa3dbd040f121b740f4a33ab87d3321275e0ef94ba3ad12479
-
Filesize
184KB
MD5038aa0c6c639b1fa911a1d7fdbae9c71
SHA131db215636878cc59ecd57eab63e8a6777140a8f
SHA256a94f43725bb782326466ca8b8deb0b99aa523f3b7373c6953f15e24cf28febd8
SHA512d02197966038f331925702cdb3375fb2973b93a69df2982d099e01ade5f1dc915808087f7804c3db9fb14b2207c77959cf494f71799f4424f97c376e6851ed22
-
Filesize
99KB
MD5076681d8bd548e01ddb1ec1f666ac415
SHA1c9d32a0870ea7e6400f24d3e033c8bb4293b4c93
SHA25640bec0464907a8dc220952e87e3542ba8166bdbdbce226909ed7e568bb71c859
SHA512b52f1918a3519316a05028eaf12a90c08326c39fe073d360110816b114fdb4d367c32ae57e6f34e71dae09485d0c128fd94cfcab196a460c17a3faea90c66038
-
Filesize
88KB
MD52c916456f503075f746c6ea649cf9539
SHA1fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
SHA256cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
SHA5121c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd
-
Filesize
114KB
MD571e4d3dc89c095aaf133544a87e88c0d
SHA1e36c917f06218827108d8ddc3d3fe050b4604e6f
SHA256d33a044adb6b90db2a871f881950aee36c259afc74ca1326c81c4b339d8ac6a4
SHA5129acf5c603fddfaee1cfab2cbb6c665bbaf3b89fe170059366dd7c1aeffdb43e73be3f3a23591edb7168d7e21d8a08d9b91d97a00cf1768301fc70326f7696af4
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
4.0MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
4.0MB
-
Filesize
7.7MB
-
Filesize
4.0MB
-
Filesize
544KB
-
Filesize
800KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
824KB
-
Filesize
1.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
2.8MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
800KB
-
Filesize
1.0MB
-
Filesize
4.0MB
-
Filesize
144KB
-
Filesize
2.8MB
-
Filesize
824KB
-
Filesize
292KB