Analysis
-
max time kernel
0s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29-12-2023 19:51
General
-
Target
024cde85d1a11c1b2e6749ec80b50fad.exe
-
Size
2.8MB
-
MD5
024cde85d1a11c1b2e6749ec80b50fad
-
SHA1
5f7226f27b0106f6050ce61d78e9c0fc8cfb8373
-
SHA256
db5d4a5090c7303616f88db08a22abc975804ae1abdef9740c208c004648255b
-
SHA512
5016d4eb26602300e49365186ce768026ac73927f41773883a6fc43376b622bc76a2d72d675cfa29224540cf82f8291a9ed03b0d5b762678d30b29f963ee7ccc
-
SSDEEP
49152:KynUHNR9PKXUm1WHyilGSvn/5Kaq1rO5n8UXRaa/B03ak8JqFJ7BHKQk6j:KyUHNjSXUmIHy8Zv/Uaq1yJqak8JqbFR
Malware Config
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
BitRAT payload 19 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\024cde85d1a11c1b2e6749ec80b50fad.exe"C:\Users\Admin\AppData\Local\Temp\024cde85d1a11c1b2e6749ec80b50fad.exe"1⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C start /min C:\Windows\system32\cmd.exe /C bitsfx.txt -p1232⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C bitsfx.txt -p1231⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bitsfx.txtbitsfx.txt -p1232⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C start /min C:\Windows\system32\cmd.exe /C xcopy "bit.txt" "C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe*" /Y3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C xcopy "bit.txt" "C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe*" /Y4⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe"C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.EXE"C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.EXE"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C start /min C:\Windows\system32\cmd.exe /C REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v "Microsoft InstallShield" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe" /f3⤵
-
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "bit.txt" "C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe*" /Y1⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v "Microsoft InstallShield" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe" /f1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v "Microsoft InstallShield" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe" /f1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
476KB
MD53acf28b2ca3be7605915fdf1718abf8c
SHA1655c278820cdf96295e0ec4bf8b4b02292afacd0
SHA25621f48a90eecb93c99dd0976cfeae732759bca91278b83ad4525b79f19ca91448
SHA512f9b09137400f4d19babff6198162d8693fe2ba295df8ede8fec6c0ccedb9da21ea21e09f303b3cf5d3327353a0f12d32acb388563842c69ba51c88a8c6ddfbd0
-
Filesize
386KB
MD5a138a183331f1a3476d3eb7833d1a703
SHA163d4e01f350c298aae0e57769030eff178424414
SHA25666d626f56f2dcaeba1027b33959409478313f38703b8e4f076dd7525fbb75ee3
SHA51213f375ad03b402b1048862f7e35b3cb2e8e6da57f4b2b56e41e226d79c20164987b21913508fa9a7afa5ae15178ea59d850c6f04c64728bd66bf8bb68106f4d5
-
Filesize
57KB
MD59531b6bf9db2d6a0403e8bd9f86bc61e
SHA12b9e6f4feec5f58364f621f9e3e09f162d5e1677
SHA256a5e35920425ae8e2635e69d7c3b0448e7df56cd7ea0c16c06f5ab6b9eb5506e8
SHA5128f999e6e88fb41996024a784dde23f6beafec5f06d697ea65c265fc92e71b7cad86150c0c60abb876da0335ce435892399a2d58756f0deea2f3a35a0b1301900
-
Filesize
5.2MB
-
Filesize
228KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
228KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
228KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB