Analysis
-
max time kernel
1s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
11-01-2024 12:14
General
-
Target
537d313f3dfe75d7a9d4f36f80cce049.exe
-
Size
1.8MB
-
MD5
537d313f3dfe75d7a9d4f36f80cce049
-
SHA1
a9d34d4ef62afbeed8f74c18c212e2c1d4c3f7cb
-
SHA256
6d7fac5d7bfe833eb0756a174ceb9ea8280cd3f9858215924284af1b559bd81f
-
SHA512
c4b698a6058f935c1db07ac92ae5e39a2e90f9e07d536ab2b6045ca539115bd1f5c7088f51d12a9edaab76befc41b0e8584a2cef4c1f906366d0a09687bbea9c
-
SSDEEP
49152:pAESWFubG04k1ImcRlJtquEwR/r28SJ4tIMBegTbV:MZGXk12nt5Fr28Sqt7UgTbV
Malware Config
Extracted
bitrat
1.38
eter102.dvrlists.com:3050
-
communication_password
fea0f7015af40ae69a386f06f28a8d31
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
Detect ZGRat V1 34 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\537d313f3dfe75d7a9d4f36f80cce049.exe"C:\Users\Admin\AppData\Local\Temp\537d313f3dfe75d7a9d4f36f80cce049.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.82⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.82⤵
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Kthavoimchnr.vbs"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\outlook.exe'3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\537d313f3dfe75d7a9d4f36f80cce049.exeC:\Users\Admin\AppData\Local\Temp\537d313f3dfe75d7a9d4f36f80cce049.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD50774a05ce5ee4c1af7097353c9296c62
SHA1658ff96b111c21c39d7ad5f510fb72f9762114bb
SHA256d9c5347ed06755feeb0615f1671f6b91e2718703da0dbc4b0bd205cbd2896dd4
SHA512104d69fc4f4aaa5070b78ada130228939c7e01436351166fe51fe2da8a02f9948e6d92dd676f62820da1813872b91411e2f863c9a98a760581ec34d4aa354994
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
6.2MB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
136KB
-
Filesize
104KB
-
Filesize
600KB
-
Filesize
6.5MB
-
Filesize
7.7MB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
7.7MB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
40KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
1.7MB
-
Filesize
1.8MB
-
Filesize
7.7MB
-
Filesize
3.9MB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
3.9MB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
200KB
-
Filesize
80KB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
652KB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB