Analysis
-
max time kernel
54s -
max time network
76s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
26-12-2023 10:57
General
-
Target
69211520423fa18fde09eee360343412.exe
-
Size
6.5MB
-
MD5
69211520423fa18fde09eee360343412
-
SHA1
dba822c016a18500e40723c7e96fa0894f025d06
-
SHA256
437ad80eaa637caba6237c5ecb0b4d328bb8131a45905088b2441bdfa021b598
-
SHA512
3378bc9725b187e9ed5be3f775c88153cfe49f053a1b1d5d0cee3d056289a4afd7ee1bbef86d8be8b7e497a244f143a29a983f8cf701f8e46338b9f23569ba97
-
SSDEEP
98304:Ld5VJppwXSyo8skn3moI25UzSOVRBKrCqflZ+VJscvKgFl8jD:LBpOwu2t26uqRsnf2VXvD6j
Malware Config
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
ACProtect 1.3x - 1.4x DLL software 6 IoCs
Detects file using ACProtect software.
-
UPX packed file 30 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\69211520423fa18fde09eee360343412.exe"C:\Users\Admin\AppData\Local\Temp\69211520423fa18fde09eee360343412.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Ukvcpgfl.vbs"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chrome\google\chrome.exe'3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\69211520423fa18fde09eee360343412.exeC:\Users\Admin\AppData\Local\Temp\69211520423fa18fde09eee360343412.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\69211520423fa18fde09eee360343412.exeC:\Users\Admin\AppData\Local\Temp\69211520423fa18fde09eee360343412.exe2⤵
-
C:\Users\Admin\AppData\Local\c3b89bbf\tor\windows32file.exe"C:\Users\Admin\AppData\Local\c3b89bbf\tor\windows32file.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\c3b89bbf\tor\windows32file.exe"C:\Users\Admin\AppData\Local\c3b89bbf\tor\windows32file.exe" -f torrc3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\69211520423fa18fde09eee360343412.exeC:\Users\Admin\AppData\Local\Temp\69211520423fa18fde09eee360343412.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\69211520423fa18fde09eee360343412.exeC:\Users\Admin\AppData\Local\Temp\69211520423fa18fde09eee360343412.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188B
MD592ed2795e0152284c6cc6486516b9cf6
SHA1d1e81202222be31f6c3197259b8ad83107598743
SHA25665167ec718a46e872471bac93f57104853afe7de650d8c0286750c140995c673
SHA51243e537d0d69912ffb7a48abb3b60513db7b8a29279111660a09150aeac1237e8895c2362fbabdec4abccef74391e197bb29e303c7d23b13235f85acd38f92a67
-
Filesize
17KB
MD5b0eb45bcc1d4cc07a0e85d800632027d
SHA1d074c572b684db4b41aef583a315d11ebd2ea17f
SHA256c846036167d97912826a83a0976fd66ca4b034eb70316f77f30b4682295eaf1f
SHA51201e75f00b205a06ee9cd817da0d9732e1b1045e7a6319f7976ad5a4accef09afe04d1094fcfa992103374fbf2400abda7ad7f103090f77907fd18c1252cfd550
-
Filesize
92KB
MD50e959da0ee1d91809cff6a912bea97c0
SHA1d055e9390d1dfcda415b3dee872d2e9e24728e48
SHA256d355fdfd092ce8cf54554630c912564f2116db71a44bc3c7533dc112bea75f38
SHA512e4ce340c1a5fb24396b0d761b6adfc31dbd0d3b6eb62cf3060ed2a327a57ae15bf0de7761a4a7b62c4b699468c8fba1041f06775412afe0a0dec67da27ecd016
-
Filesize
112KB
MD52b4a7a063c3298d996a8f16a95e79df7
SHA1ac9a90076d4d6efc74d5e31ffc795f5561bc3fb8
SHA256d6338b98149d2608f5dba45dcc5d234a747a7d9d215b8adf7fc41dc01bc5bc96
SHA512777da2f95ff42fd6a37528e181a0c9e9ebad0476fd27f91e88438b1021aaff71c844a358d3438af4f5af1b52f44f37786385aff0d84d9560ef22ea73ef030802
-
Filesize
38KB
MD528d6e1d45404868e7c2ae8d821da1b32
SHA1a14ce100692d469eca261c37e30999a64cb29a0f
SHA256fad9491c560f70b324f3af59dc6b4c643d925fe921498ec24be17781e451ba61
SHA512b19288484bdbacd09d4e274992538d6f93f1aad4241611db75c4f3bf0ff27d39b1c1cdd758d8a83cefb809d3f1da21db407f4b28ffd715e306943bc04d7b2143
-
Filesize
91KB
MD5ef5b7b6232ee4df2682cd09774d493fc
SHA15631b124ab37c36e88825daa95ab500b2011693f
SHA25690fc022cdcb27b981ab7a226cc23e951ca5a0cf35c643b03b0edddb2b9d2f69a
SHA5125fb8854a0d3b0758b844d8a3f340cb5c4f51bd03b236d06dce30cdb0b2248eb0629f8bb021f9f57b0e9e1c708411adf2b6f56cfc2daf8d8fcb2e89e57ec35210
-
Filesize
44KB
MD5376450eaef23cfea317aab29b82d7b64
SHA1c18141dcd4c235920f35df0caf7bd34a45d197e6
SHA2565c5df77f6b7b025050407155dda6fe4cfc0ff738b16816092e79be67b5f8074f
SHA51253aa80de0d369b60df65ce729a70fc3d2d5446cfbdf4aaeefd1b1b9a5d06ce2cdb876bf5c9a95687d5376787889e29f61fd4d28f11e59a27596e9e30a53f659b
-
Filesize
92KB
MD548253da36ff619aa79072cc6188082df
SHA166d85b35fe301b4b688f35bc5808f54a40f653c2
SHA25624d9b0dcf7daca724da11ab16db6be2131deff78b3e536c5078ce80c73acfe5b
SHA51250af9724de9abc5d8ba14fc8afe9ada804e05acbbff3575b83071ae93396dcededd99b295376b482b841bc236ce6caa2ec22680d9ef0e8a5eada6ed3ec56d7d0
-
Filesize
52KB
MD5add33041af894b67fe34e1dc819b7eb6
SHA16db46eb021855a587c95479422adcc774a272eeb
SHA2568688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
408KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
652KB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
40KB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
80KB
-
Filesize
2.8MB
-
Filesize
4.0MB
-
Filesize
800KB
-
Filesize
1.0MB
-
Filesize
544KB
-
Filesize
144KB
-
Filesize
292KB
-
Filesize
824KB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
228KB
-
Filesize
7.8MB
-
Filesize
6.5MB
-
Filesize
7.7MB
-
Filesize
336KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
184KB
-
Filesize
7.7MB
-
Filesize
800KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
800KB
-
Filesize
2.8MB
-
Filesize
4.0MB
-
Filesize
292KB
-
Filesize
1.0MB
-
Filesize
544KB
-
Filesize
824KB
-
Filesize
544KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
144KB