Analysis
-
max time kernel
42s -
max time network
83s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-12-2023 16:57
General
-
Target
2ef00e66804e808f9c5a4d6a1943cc8a.exe
-
Size
4.2MB
-
MD5
2ef00e66804e808f9c5a4d6a1943cc8a
-
SHA1
6c7a46a69ac5d3f32d047a14c8ce03c1a53ec3a5
-
SHA256
c21010f7c87e95f3df9c061e697437f5a165a194f69c88887ed36c6217b71d48
-
SHA512
01380f1fafd75cd33e413282019305f525c410a2939525babc4ef0d2b529bd12db7349f066724d9ad473ce41c5c5ecf83d9e7cab560c37fb149ac3e3b77afb5c
-
SSDEEP
98304:MosKQ+SGjJLHXW5ru4IufoXqXBEQzpPYKXsJuBfkL3O2s:Mos2SGj93wruGfoXqXBR8uBfL
Malware Config
Extracted
bitrat
1.38
snkno.duckdns.org:43413
-
communication_password
827ccb0eea8a706c4c34a16891f84e7b
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrjKuutveP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpECA2.tmp"2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
4.1MB
-
Filesize
3.8MB
-
Filesize
4.2MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
228KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
228KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
228KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
228KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
228KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
228KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
228KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
228KB
-
Filesize
3.8MB
-
Filesize
3.8MB