Analysis
-
max time kernel
57s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27-12-2023 12:20
General
-
Target
b087a691094f9fdd25b7b1828ff7d9fb.exe
-
Size
4.6MB
-
MD5
b087a691094f9fdd25b7b1828ff7d9fb
-
SHA1
78882a7d0aef6b8b1a190fa50ea82373bf4d3b88
-
SHA256
954eeaefa91f80e80df9cc550c0cc16f52ad063f8ca3494c40ebc5c51ebc635b
-
SHA512
4f4e1e6da8b96b1984ba4f5a378b442c5671940af3c0fbd2102b6ba4ef15259d88f23e2df38770e91f2389dd439c507561dec820ad471b14148a28fc747b3a83
-
SSDEEP
98304:RM3sD4Wo+QeyE5fjBdsc+zm4o6kz5KRVBQAWBxfGU:RM3sD4WSDe8rPkz5KFRu
Malware Config
Extracted
bitrat
1.33
serviceop091.ddns.net:8000
-
communication_password
c4ca4238a0b923820dcc509a6f75849b
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b087a691094f9fdd25b7b1828ff7d9fb.exe"C:\Users\Admin\AppData\Local\Temp\b087a691094f9fdd25b7b1828ff7d9fb.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tBJkUjvPFcL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF299.tmp"2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52d55d31fe80ec5f6deb0dd099da59b13
SHA1745254e20c35a9cbc5dc16af42788797ce7b29d9
SHA25683247db20fe6a3700ddd31fc182f3426bd53718e51dd7f6ea2d890965e50a246
SHA512745a7322ad19cb65fcec35d7e5e3ecd18d3657b2557be48a2810be46e56ffb5d7487160fd729587250570400595cc319e2d2f223b5cc9bb7df37c607147f60c3
-
Filesize
6.9MB
-
Filesize
4.6MB
-
Filesize
256KB
-
Filesize
96KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
4.3MB
-
Filesize
6.9MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB