Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
20-01-2024 01:25
General
-
Target
69211520423fa18fde09eee360343412.exe
-
Size
6.5MB
-
MD5
69211520423fa18fde09eee360343412
-
SHA1
dba822c016a18500e40723c7e96fa0894f025d06
-
SHA256
437ad80eaa637caba6237c5ecb0b4d328bb8131a45905088b2441bdfa021b598
-
SHA512
3378bc9725b187e9ed5be3f775c88153cfe49f053a1b1d5d0cee3d056289a4afd7ee1bbef86d8be8b7e497a244f143a29a983f8cf701f8e46338b9f23569ba97
-
SSDEEP
98304:Ld5VJppwXSyo8skn3moI25UzSOVRBKrCqflZ+VJscvKgFl8jD:LBpOwu2t26uqRsnf2VXvD6j
Malware Config
Extracted
bitrat
1.35
4napo6g3cp6av4hmxmwzi5lyojpfk3i2kl2tpssb2wvidqsa3kzo6eyd.onion:80
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
windows32file
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
ACProtect 1.3x - 1.4x DLL software 9 IoCs
Detects file using ACProtect software.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 24 IoCs
-
UPX packed file 41 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\69211520423fa18fde09eee360343412.exe"C:\Users\Admin\AppData\Local\Temp\69211520423fa18fde09eee360343412.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Ukvcpgfl.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chrome\google\chrome.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\69211520423fa18fde09eee360343412.exeC:\Users\Admin\AppData\Local\Temp\69211520423fa18fde09eee360343412.exe2⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\c3b89bbf\tor\windows32file.exe"C:\Users\Admin\AppData\Local\c3b89bbf\tor\windows32file.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\c3b89bbf\tor\windows32file.exe"C:\Users\Admin\AppData\Local\c3b89bbf\tor\windows32file.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\c3b89bbf\tor\windows32file.exe"C:\Users\Admin\AppData\Local\c3b89bbf\tor\windows32file.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188B
MD592ed2795e0152284c6cc6486516b9cf6
SHA1d1e81202222be31f6c3197259b8ad83107598743
SHA25665167ec718a46e872471bac93f57104853afe7de650d8c0286750c140995c673
SHA51243e537d0d69912ffb7a48abb3b60513db7b8a29279111660a09150aeac1237e8895c2362fbabdec4abccef74391e197bb29e303c7d23b13235f85acd38f92a67
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
13KB
MD5b26791069ac5fc9ab70727332309e1e8
SHA106084afcec65f81a9b3e3773b5ab463e1c5b5479
SHA256bc8073b4255ea5c64fa4380689d8f6921e9fcd853bfe4bae9b23e4dc67aa57d4
SHA51274aa8675732805857fae329f2ee3f40fc83974f1ae72a4d259744b611c3771239180a3c18622d0cd70d26b5e218a9ba62df58d3ac1598342fbc02b3b26b2810f
-
Filesize
2.7MB
MD5408e6065d52048a86ac4dce5cdcebcc6
SHA182546a2a61e23423d22151ad4b792f44c4f3cd9d
SHA25690c5ecd6763e4c8c9239a017c6a69daa4fef7ecd53e2da009756fd4ffbf39d54
SHA512026786d92dd2b2d9c386769baacd6850ace08b11a10c6c564d6103d04fc3057448399240258d2bb304c82d762593ffc761061a5908ecfa218f99cf5d8a0343db
-
Filesize
780KB
MD5b1f4f4cfcec464ac7073feccf78036b8
SHA1b9852b699336012520d494bead2bf209ec8e2a13
SHA25643a7af377cfc95b1b04e6bb9c3e6d0b811a78c3fdd4a250d21f4cc6edb18bdf3
SHA51251c35e1315ceda2808e1cef5504161ae7914b9af789db48cc7e12f00d30d68b07d3a6d7de058a81e243a0af150399e64373a4b3c8eb9a4c6671b015b80894778
-
Filesize
3.1MB
MD5ec07655f3cd44a2e1b19ccb0fd9a071f
SHA1cb803bbd95408b5cc5152a713a68a9a5776e48ae
SHA256a8ef043558b5ab296527534771b9b58e794c0fd21947c8034a98d95aa39ba1b5
SHA512dc40674c26a4f59b00bada48314f37c27cade60c3564a38c903d5eec4ac3895e2f032b9cd2948b7c50dc350b73bbf54172d2831efc96a2b531a63cfbe846481b
-
Filesize
21.4MB
MD5052455dbe94d3df3a1a28d54c90a1afe
SHA124e7a0b41b4c6ab81d29bf5fd7e96a1f3c9aac6d
SHA25645c11b639887b665389dcce2bee08e505ffa12e4b1cd16bc0beea418de629964
SHA512964856639173d43bc87f82e170fc6347fbb77a57545d496f7ac5533e94c71fde250e5fd6dae0b972cc0d9b102bef523c88bc4fd32a3ae5fe04027c4a39a8ded7
-
Filesize
232B
MD574ee9f8d6a8206542da3f2541e4c8a1d
SHA1e4e9b24a2173b8a1f8f07b9fbdb9da11a50e3e70
SHA256a635a327906b86562bd49b8c830b552b0992435a6e34421cadb6d9fefcdd870b
SHA512de59924fd3b1036aeb7911da996ddd0199560af7b075205ce6aca8347fd67c042077818b4871e91de980a322a5b0598eb8bc8a3d9554b97c6aed962286520f68
-
Filesize
716KB
MD556d34407ce6a5a9ece1e3b99d05f099d
SHA1cd049d5e1bc047b3d587b2afa8a2fa472ac92e3b
SHA25639639f0b4ea177968c8ca6a5fc7ce1dbf814e05a26923aec6d97067fc46e547f
SHA51234ad39c568ebd1e8993bf282e713fb5053360874f8d2343a0c20618f6c644f13f29fe0f40578055ddcc5274cc7977fd92e058d17cde86cfaedb11b0a0ed0375f
-
Filesize
1.7MB
MD52384a02c4a1f7ec481adde3a020607d3
SHA17e848d35a10bf9296c8fa41956a3daa777f86365
SHA256c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369
SHA5121ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503
-
Filesize
1.4MB
MD510f0676f9e57451a1d01e261e100c8ff
SHA1564e850c87c061ee6f4529aaf432b69d63327d12
SHA25663a977c7e6fa4e878547c3db33fff6ab5633fc56012d6f2448ad9b07641617c0
SHA5127d7c294a17da5cde783153afa4be660ac24b5017a1e80f663007272465e7b65ab7c4d73324c74ebd70147ce22b1e6be218ff6344b26f1bd9c97cb6b762bf8ae8
-
Filesize
366KB
MD5099983c13bade9554a3c17484e5481f1
SHA1a84e69ad9722f999252d59d0ed9a99901a60e564
SHA256b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838
SHA51289f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2
-
Filesize
286KB
MD5b0d98f7157d972190fe0759d4368d320
SHA15715a533621a2b642aad9616e603c6907d80efc4
SHA2562922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5
SHA51241ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496
-
Filesize
439KB
MD5c88826ac4bb879622e43ead5bdb95aeb
SHA187d29853649a86f0463bfd9ad887b85eedc21723
SHA256c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f
SHA512f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3
-
Filesize
88KB
MD52c916456f503075f746c6ea649cf9539
SHA1fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
SHA256cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
SHA5121c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd
-
Filesize
188KB
MD5d407cc6d79a08039a6f4b50539e560b8
SHA121171adbc176dc19aaa5e595cd2cd4bd1dfd0c71
SHA25692cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e
SHA512378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c
-
Filesize
157B
MD510e4369f9761d5401203f24a43aec777
SHA1f6237d60d66f0bdc642836387c2e9adaf60114d2
SHA2561936b09146613154cc18a4889276cb2de96a5fd24a2c86d34a778be90f965976
SHA5127159148f7584cd188d7f030ac1be482ebad86cba6e964fdf2d6e673823027ebbb049ad9fdac15ed556976760953216a999c5145a0816d67072ed232bdc9e4abb
-
Filesize
973KB
MD55cfe61ff895c7daa889708665ef05d7b
SHA15e58efe30406243fbd58d4968b0492ddeef145f2
SHA256f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5
SHA51243b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da
-
Filesize
483KB
MD5a51c06907e72df902a5eb79b0637e095
SHA11f6abc67b3dcd787233265466234297d5fdfed46
SHA256b69569a7188b7896c421dd2c0233c117a2bfb4d1b152cc0073d24c1a1f70d9c7
SHA512781650359fa85cc55a4f3fd2cc18c0308f8e27fd2848ecf5ae0ecc40229aeae0e9c251ed12aaea048a9f502c6e571a271f99381e0fed65b01585cc34c1a1e295
-
Filesize
892KB
MD597cc3ec5040c880a7635228857668868
SHA19e5cf88bbd3ee028ff1f996d63a97ded1741b25c
SHA25607d35700ef68638e345e958e0032fdd90752cb15318c94096eb2abed3d6ef7e6
SHA512eb188768243e08ab9968f682b911215ea1230d34ee6a9be8e6ee3bead148b4ae07e2464fe16404210d747f05099bd6583764d83154c33feddff355ab37802def
-
Filesize
831KB
MD5c95460d879afa09936b5fa1326763ea8
SHA100c96fdbe096d0887dd114915625f3f0e12ad0e5
SHA256af1cfdf275f018830ee6041a4fde8a51ef5de989698bf7ab31bba34addc3443d
SHA5124179cacf3e45576581d2313ea6186e2ec2243e7dcbcda60eb819cbf8f0abe1593e3d6d411097798fabe7a83190c7962a79e63ee5c5edaa29e7a1ad1b48854293
-
Filesize
52KB
MD5add33041af894b67fe34e1dc819b7eb6
SHA16db46eb021855a587c95479422adcc774a272eeb
SHA2568688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa
-
Filesize
4.0MB
-
Filesize
2.8MB
-
Filesize
824KB
-
Filesize
800KB
-
Filesize
292KB
-
Filesize
144KB
-
Filesize
1.0MB
-
Filesize
544KB
-
Filesize
200KB
-
Filesize
56KB
-
Filesize
6.2MB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
652KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
68KB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
80KB
-
Filesize
1.0MB
-
Filesize
544KB
-
Filesize
4.0MB
-
Filesize
544KB
-
Filesize
2.8MB
-
Filesize
824KB
-
Filesize
4.0MB
-
Filesize
544KB
-
Filesize
4.0MB
-
Filesize
144KB
-
Filesize
800KB
-
Filesize
292KB
-
Filesize
292KB
-
Filesize
2.8MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
144KB
-
Filesize
800KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
336KB
-
Filesize
584KB
-
Filesize
6.5MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
184KB
-
Filesize
4.0MB
-
Filesize
292KB
-
Filesize
800KB
-
Filesize
2.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
228KB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
228KB