Overview

overview

10

Static

static

3

f16151d0d1...c5.exe

windows7-x64

10

f16151d0d1...c5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    09-01-2024 18:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f16151d0d1ea959552d2fe8a724b0dc5.exe

  • Size

    5.0MB

  • MD5

    f16151d0d1ea959552d2fe8a724b0dc5

  • SHA1

    d71382495ec36153ce86cb0e94755d283fbe53e6

  • SHA256

    6248ca77e095fba357308535038777b0e555c085dfa828a6f16faac4d818a7a3

  • SHA512

    3f9b550ed515a5e0f3f99f2235bef39d1a8332496b1e37cdf107c1ab4d54875c8a6142d3a5c277c504328b04821cd8d46608e0c2c977a4c256e1530f20096e57

  • SSDEEP

    98304:viS/sRZddY2EGcHg/InwJtNELakTwPAALRuPa6o0h7:vxkZdCvGwbaYTas5o09

Score
10/10
bitrattrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

elevenpaths.cc:420

Attributes
  • communication_password

    e48e13207341b6bffb7fb1622282247b

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f16151d0d1ea959552d2fe8a724b0dc5.exe
    "C:\Users\Admin\AppData\Local\Temp\f16151d0d1ea959552d2fe8a724b0dc5.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2824-0-0x00000000001C0000-0x00000000001C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2824-2-0x0000000000400000-0x000000000090E000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2824-1-0x0000000003900000-0x0000000003DA9000-memory.dmp
    Filesize

    4.7MB

    Download
  • memory/2824-3-0x0000000000400000-0x000000000090E000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2824-4-0x0000000000400000-0x000000000090E000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2824-5-0x00000000001C0000-0x00000000001C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2824-6-0x0000000000400000-0x000000000090E000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2824-8-0x0000000000400000-0x000000000090E000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2824-9-0x0000000000400000-0x000000000090E000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2824-11-0x0000000000400000-0x000000000090E000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2824-12-0x0000000000400000-0x000000000090E000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2824-14-0x0000000000400000-0x000000000090E000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2824-15-0x0000000000400000-0x000000000090E000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2824-17-0x0000000000400000-0x000000000090E000-memory.dmp
    Filesize

    5.1MB

    Download