Analysis
-
max time kernel
108s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01-01-2024 00:39
General
-
Target
3b7952b29980779fe69f90ebc56b39ac.exe
-
Size
7.1MB
-
MD5
3b7952b29980779fe69f90ebc56b39ac
-
SHA1
aea379258d2b742954f87fb09297437129be83e0
-
SHA256
0b368ceedd88f3d520acf7d03f6a8b00d6edc97f6b336e3a0ca6729b36a2a096
-
SHA512
69c3bad648de36a6141bf59eecb57a6905e02f76e348ff8c1ed012164688df9d91301b0fb855bae15b12ce44720c980cd39181046c382b467bc6ddfd33d67275
-
SSDEEP
98304:0g+HCvkRk5zvfpfuFAcUs4tmGqtLG6YhXp0zpTK6skwdKimkqW8NmPQEC39qs+Qb:GkkRkdvfp2TJGmZpPiG9EgDU
Malware Config
Extracted
bitrat
1.35
cm3thejmzhlxpvowsv2dk4ybpovmoaqal7o7gqirhgvj24l4ww7w7zid.onion:80
-
communication_password
c96170c5f601c0d15b5a7dc0ddb57ca1
-
tor_process
crss
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
ACProtect 1.3x - 1.4x DLL software 11 IoCs
Detects file using ACProtect software.
-
UPX packed file 33 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b7952b29980779fe69f90ebc56b39ac.exe"C:\Users\Admin\AppData\Local\Temp\3b7952b29980779fe69f90ebc56b39ac.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3b7952b29980779fe69f90ebc56b39ac.exe"2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yocHewonEtYr.exe"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yocHewonEtYr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE6C6.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yocHewonEtYr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3b7952b29980779fe69f90ebc56b39ac.exe"C:\Users\Admin\AppData\Local\Temp\3b7952b29980779fe69f90ebc56b39ac.exe"2⤵
-
C:\Users\Admin\AppData\Local\b7d4886a\tor\crss.exe"C:\Users\Admin\AppData\Local\b7d4886a\tor\crss.exe" -f torrc3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD547046f506ce779bb4abf611f8a28a7fd
SHA181da018f178d63959295415b7c78ec663802db61
SHA2565f4d424b6126876adb943613abcb23e29db8f1f1a006269a27355c2dfc4d06a4
SHA51285c7028a02a8cf8f1425d2615b303a6354f8e17fe6a039c1a15858cba0722eb96d82166f1a74968b84e25057ccdfba3c46eb3e6a70c6ff75dc323f88df056ff7
-
Filesize
83KB
MD5d9fc7093e42a1abb4ed339c169577cb8
SHA1b156d0a58e1d18e2a53ba04182240bc07305dbb3
SHA256dd63da592a95b3419f38cc1bea45ab0d3dc03c20acd615b88b9381e880d92c58
SHA512739f9d57a80bea312960764a75523e2c7dc5629e397c4ffdb783616ccde21509f72c763021b0b718b316bb1ce7db5a3a70f040558452b35334169ff44ac1cdec
-
Filesize
193KB
MD51be12ef972f14ac9bd39ab58a321f973
SHA11ab0f0d76a5d4832dc56baccae2e4ec1c898c35f
SHA2566977d5fa58f360a28308c25e74522f53be2f48fabb9a12255a13f45cc3fe148e
SHA5123e1f97141d51cb43c3be90e2cc213bd6abc7ce8346159ca3dd24ef39a9892973a3a80b3f42ee979090063077334be11bdd8f9ba63dbc6d8f9a79b91bab333ba5
-
Filesize
211KB
MD5e2aca1b604c43ea04f781e8ce38caf5c
SHA12c69ad795262469eea134e32b76cbd6a25c16461
SHA2568e70042f96f41275ce41d36db739c7e6662f4e726f577eab6d718c80ab3e153e
SHA512a658aa31a074c74343127e4be6cfe639165bf8683b16992814b2fc786b897974e5bff01036bae75685410e2cb3f14a83bdf8b47fc3ed343c95315429d8c9f90b
-
Filesize
106KB
MD55658aee8cc8b76473ed0a156e241a0ce
SHA183f1d1f81e7feada3aa4aa885a7fbcb0348b76e3
SHA256eefcd3d4cb99e3da885999030559fd45e6e1c3e8ff0e5fdda4fc27e115eab073
SHA512475273ec20ec15afcb9da50b90cb621b601a9157638b9700f5ff8e356a822e5bc5ba5e176213d4fd83d51bd79231d0a097d77508aee7de4b9ce985471a5d487e
-
Filesize
78KB
MD5b0f8ce55ba12b701651e16499156b7db
SHA105d0824549e8c6e942ef03bb83bea073611ae4dc
SHA2564bc25014af3aa51ae0f2f6a24b2c4f2d9a2242743ce2b04403321c67bbf36854
SHA512641eed981457c1e63e9e89139886b1ce026056b99c5e7dafeffcff4b7abc669deb560c5ee02f3a3110a2d4eef762741b868689a687ec3f3e2b0485501212faf2
-
Filesize
79KB
MD55e815cc508f668f8e4b2cdc85af4c91d
SHA1b4e6e070ce61bf3c2a48c46318530558e61c74ed
SHA256dec49cf40447d5888891dde2a6ca3126db325b3235e20df2003b1cbc98d9657d
SHA5129006880595176b2afd1197fb3cc87bbba9283767721d31dc4fac1763164e11f713f65e7f0b2a260b20002357083d90d6663c6a69e9b5441052a328c97f39b0c4
-
Filesize
188KB
MD5d407cc6d79a08039a6f4b50539e560b8
SHA121171adbc176dc19aaa5e595cd2cd4bd1dfd0c71
SHA25692cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e
SHA512378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c
-
Filesize
157B
MD5d047d4bc2b3b6c2211c0c9054211f7e6
SHA1b7927b0393b62ed66736cb458306cb49413fc0a3
SHA256517c9bdbff549fdf7e4c59e452ae92a5425a623d8f8ecea4a17686fb59ee5d21
SHA5126f05f93ceef6ebf3742fe0f1c7bbc881acecc693a6b2332b16055bf73ac7f8ec3994a2705b85db6d80a9a7365ccec0f610d65d2af574246e466829d2d56c009c
-
Filesize
7KB
MD5bd3424e578592b0f196ca4043e076626
SHA1a2546f7a599e149234dc749985bf44bd18994357
SHA2566b96416ffed2157297148717d4b7462f11d8199fcc27dd7a9a9694d60544471d
SHA5124b6f753c06dabdba5304b823599c9d40213c113fd1bcfb0b27b607bd627d695e6db940bb232a180fa39eb98b678685a258c57e636951765b8f67ec0a4973877f
-
Filesize
99KB
MD5ed10e472b5dfff655db666ec27287934
SHA18407c667816789e519be2c8240be2eeb740988d4
SHA2567069810891f88fe8c680f8df22185bcf35f03e7e83c29f30a30672a88d7854a3
SHA5121055ab9ddcd3cac91e0a28dc17007b60c6c79f00274a83a689e25697cd4729e21d8fa8847b921d99e7fdb6d36bb6242c08e68ea180d83370ceaddf049f02a224
-
Filesize
513KB
MD52aa3f8acd80555f24e78d903b7c35fc1
SHA17be3498f1dfbd02c08f8f181e7f09ff5a9fbdec1
SHA256bf9f26c2b6390acf68dca187c0f1614490d128ed4c41f709f248a3308c29d888
SHA51292db40f907258d0e5c6d063b079281e8699e43ef8aaf9de4f7cc0d5f5e069fb70e6bda6767d6f3f255b15b1a988606144056548850eb30bcd497e03cc69d4de9
-
Filesize
165KB
MD50777b28ea199e8f7af938287c523aa4b
SHA1184cb947a98eb46f136c75b763586fc4bee8ed79
SHA256f0eea8e4585926650cbfd3c196c9bf39888c271e786ffea063ab3c7186b4e9ef
SHA5124eb5a8a31d0a9c1afa93950302759fac9770ca02c86ea0c16142922898c0abdcaa8da7af4ff5467f44f301837329eeb6f713db8ee1d52e292f94ece97a4fba4a
-
Filesize
175KB
MD50034c82226b4b1cc080dadc79ad2748a
SHA1bf8c8ae18ff0354d101ceb37359e00ae8b949782
SHA2569c6207081b41428a37382fd5fc499fede0e1100f67de6afe54417ab71d7ecc78
SHA51296290e8b971070fa8df2c46e60c5d1ee86e86633f8ccb52cd11a03f60dfdc9bd70e734a32bbf17bb3b50f390c34dd4de8c5e324be543e5e3cb166acf46e99434
-
Filesize
195KB
MD5eba4b76da0f69486db77f7de797cdf48
SHA1b92cb0a9ac0da386bd25d339614d0b56f5af3537
SHA256331f5c35c43da01667052169e21aa32b88ae52195c902c3dea6e73159667de65
SHA512f4316e336d3d9e7099444dd7e91aa72c193f513076a95450474927bfdc971dd9bc1029fbda6627512f778357a5215c57f5a852acbbc1e81efe12e5cc0fc32341
-
Filesize
99KB
MD5740604048db88840bae55bee2769eb02
SHA15a13dbb8790fc0b570929e876e3afef034070264
SHA2568ea05c4f4bae08623dadf7772584931ecb84b5a89dd7c9c88989163f161d6ed4
SHA51249eb1c959c15c4f4c9764cc60c9e07d0673842440b670ff59d77df9aa491b3026adbe2a228dfe5294ab834c88d958146954b49521c51392bad6000a0f59c4ecf
-
Filesize
88KB
MD52c916456f503075f746c6ea649cf9539
SHA1fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
SHA256cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
SHA5121c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd
-
Filesize
52KB
MD5add33041af894b67fe34e1dc819b7eb6
SHA16db46eb021855a587c95479422adcc774a272eeb
SHA2568688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
4.0MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
4.0MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
4KB
-
Filesize
7.8MB
-
Filesize
4.0MB
-
Filesize
7.8MB
-
Filesize
4.0MB
-
Filesize
7.8MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
6.5MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
7.9MB
-
Filesize
80KB
-
Filesize
7.1MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
824KB
-
Filesize
544KB
-
Filesize
1.0MB
-
Filesize
144KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
2.8MB
-
Filesize
4.0MB
-
Filesize
292KB
-
Filesize
1.0MB
-
Filesize
4.0MB
-
Filesize
800KB
-
Filesize
292KB
-
Filesize
4.0MB
-
Filesize
800KB
-
Filesize
2.8MB
-
Filesize
824KB
-
Filesize
544KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB