Analysis
-
max time kernel
191s -
max time network
197s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30-12-2023 10:03
General
-
Target
15478642d48681a67374167d173d4f84.exe
-
Size
4.9MB
-
MD5
15478642d48681a67374167d173d4f84
-
SHA1
9790217e8b9a2134f2abf451ac68c847dc31c905
-
SHA256
4e1c013bf36b27f78e0fdc7ab5a67bc3f62f33c97f5848daf40df7ec7d842fa4
-
SHA512
4b8c58f0605c562bddddabff542b76a06a65206c90c3bf430752785287fc88afc2a38c7780e1d94650735ec9a0f45ad8d9540e10fd0300734626c867d0ee5819
-
SSDEEP
98304:6jT71ntlY5xzFunCcZ2iH9oFfQPjpw6D8cKuEBQ5Qbg+db778Fm/S3DdK1NPgf6K:i3fCcZZ2VQtbXQ9A5DdK1NPgCWXaYRX7
Score
10/10
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
185.215.113.102:1234
Attributes
-
communication_password
5d55208d3d81a0bf50741250fe5b93d7
-
install_dir
GuiterX
-
install_file
GuiterX.exe
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Suspicious behavior: RenamesItself 28 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\15478642d48681a67374167d173d4f84.exe"C:\Users\Admin\AppData\Local\Temp\15478642d48681a67374167d173d4f84.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2684-0-0x0000000000400000-0x00000000008EE000-memory.dmpFilesize
4.9MB
-
memory/2684-1-0x0000000000400000-0x00000000008EE000-memory.dmpFilesize
4.9MB
-
memory/2684-2-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/2684-3-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-4-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-5-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-6-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-7-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-9-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-8-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-11-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-12-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-13-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-14-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/2684-15-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-16-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-17-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-18-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-19-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-20-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-21-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-22-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-23-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-24-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-25-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-26-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB
-
memory/2684-27-0x0000000002C10000-0x0000000002FDE000-memory.dmpFilesize
3.8MB