Analysis
-
max time kernel
71s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
28-12-2023 06:08
General
-
Target
ca5cb50618d8df2b8f67fb562d535a1b.exe
-
Size
2.8MB
-
MD5
ca5cb50618d8df2b8f67fb562d535a1b
-
SHA1
e648d0dc065cd1d017f805dc29e5e26ee65c8273
-
SHA256
cdfe884cee1ae053d17300dfe2ddc89e21371fe4fea96d1102069685a9e71f56
-
SHA512
942467e68ae0f765d72377ef4698c56d9cc2b799894db85ecfe03bd77d0b5df8a3896623d12b6c0862ceb2e236c25d8a1962d4f07a2d7985af57a5f5b37e118c
-
SSDEEP
49152:uE/UJ104hpI+JOK1DCSnpCsVhwie8rqk8T:DT
Malware Config
Extracted
bitrat
1.38
139.28.219.47:64576
-
communication_password
4a7d1ed414474e4033ac29ccb8653d9b
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
Detect ZGRat V1 34 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca5cb50618d8df2b8f67fb562d535a1b.exe"C:\Users\Admin\AppData\Local\Temp\ca5cb50618d8df2b8f67fb562d535a1b.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Bhvohqh.vbs"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\jusched.exe'3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ca5cb50618d8df2b8f67fb562d535a1b.exeC:\Users\Admin\AppData\Local\Temp\ca5cb50618d8df2b8f67fb562d535a1b.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
137B
MD554dbeebd94ab33ba092390548db30f03
SHA1d08403310ce5c5f36439409d727a9ab74c9b7cdb
SHA256cfa50535cc06ef74329b8b2b3610fcd8d6fe629ae0637b6ecdf3b05b55f723d7
SHA5126b832b2303a0af4fd2e7cd962517d93df47ab6b3ba3b72c464e5d30698c54dbca343cff373649bce064265e0fc35bc10b78d0530f30a90fe382091e60d51b864
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
2.8MB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
2.1MB
-
Filesize
496KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB