Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

D3E0800E55...D2.exe

windows7-x64

3

D3E0800E55...D2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2024, 20:23 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    D3E0800E550889AD45270980CA5D31D2.exe

  • Size

    65KB

  • MD5

    d3e0800e550889ad45270980ca5d31d2

  • SHA1

    3cc43700ce7b812c3c90d74b1fb7757cc14dd026

  • SHA256

    41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229

  • SHA512

    bf4b5ae13f5ae0371d87c33245e54271f45b93a213adc9cc7328d10df1f249efb165718d4949b1320e9223a3d8d313460d9386599ede0366842b527c03a3be1c

  • SSDEEP

    768:Y/qvB/iUdgf7x44gpjoc3+0gJou/WDkdR0ybsazEPMV8PMeNkyAqFnviseo:hJqpXSotK5aeN5Jxviseo

Score
10/10
bitratzgratpersistencerattrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

pradeepprabhu705.ddns.net:313

Attributes
  • communication_password

    827ccb0eea8a706c4c34a16891f84e7b

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • Detect ZGRat V1 34 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\D3E0800E550889AD45270980CA5D31D2.exe
    "C:\Users\Admin\AppData\Local\Temp\D3E0800E550889AD45270980CA5D31D2.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:812
    • C:\Users\Admin\AppData\Local\Temp\D3E0800E550889AD45270980CA5D31D2.exe
      C:\Users\Admin\AppData\Local\Temp\D3E0800E550889AD45270980CA5D31D2.exe
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2552

Network

  • flag-us
    DNS
    61.179.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    61.179.17.96.in-addr.arpa
    IN PTR
    Response
    61.179.17.96.in-addr.arpa
    IN PTR
    a96-17-179-61deploystaticakamaitechnologiescom
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    cdn.discordapp.com
    D3E0800E550889AD45270980CA5D31D2.exe
    Remote address:
    8.8.8.8:53
    Request
    cdn.discordapp.com
    IN A
    Response
    cdn.discordapp.com
    IN A
    162.159.134.233
    cdn.discordapp.com
    IN A
    162.159.133.233
    cdn.discordapp.com
    IN A
    162.159.129.233
    cdn.discordapp.com
    IN A
    162.159.130.233
    cdn.discordapp.com
    IN A
    162.159.135.233
  • flag-us
    GET
    https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat?ex=65b6f023&is=65a47b23&hm=d10599d908faa98f4e38c8fa05f7618af09346cf599dade55a0c93fb6feff152&
    D3E0800E550889AD45270980CA5D31D2.exe
    Remote address:
    162.159.134.233:443
    Request
    GET /attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat?ex=65b6f023&is=65a47b23&hm=d10599d908faa98f4e38c8fa05f7618af09346cf599dade55a0c93fb6feff152& HTTP/1.1
    Host: cdn.discordapp.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sun, 28 Jan 2024 20:24:10 GMT
    Content-Type: application/octet-stream
    Content-Length: 2460672
    Connection: keep-alive
    CF-Ray: 84cbf518f9ce240e-LHR
    CF-Cache-Status: MISS
    Accept-Ranges: bytes, bytes
    Cache-Control: public, max-age=31536000
    Content-Disposition: attachment; filename="Jvvlpovxdup.dat"
    ETag: "01eee424f31deb90fe2b4c0822eaa25c"
    Expires: Mon, 27 Jan 2025 20:24:10 GMT
    Last-Modified: Mon, 15 Jan 2024 00:24:03 GMT
    Vary: Accept-Encoding
    Alt-Svc: h3=":443"; ma=86400
    x-goog-generation: 1705278243620492
    x-goog-hash: crc32c=i6Ohyw==
    x-goog-hash: md5=Ae7kJPMd65D+K0wIIuqiXA==
    x-goog-metageneration: 1
    x-goog-storage-class: STANDARD
    x-goog-stored-content-encoding: identity
    x-goog-stored-content-length: 2460672
    X-GUploader-UploadID: ABPtcPoEbvuEVzsUCSdQ2JUMSbLa3NTf9jUrBeg2lyiTEH8R4uIYMp-AUUqW5ked_rhGQ8VRku0lLUDyVQ
    X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
    Set-Cookie: __cf_bm=fL9vktHA8YPgZNHaPHS2JEGMFTh4JvomH3tWP5LWJeY-1706473450-1-AT8i8J0Vlfs3jNgzDltM++R5k/L7xGqdbcnrfPMvhthAJSBTNon9dZUSiWHmfI1qDwUPOSXIobbsiFBDuo8ZuEA=; path=/; expires=Sun, 28-Jan-24 20:54:10 GMT; domain=.discordapp.com; HttpOnly; Secure
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iFpChAt7o%2FgxFxdW2iw8DAwXZvinyB93WKC0BmHakiKfvWhSZWRYdvIwlap1d720ROrnkck%2FpTMdG4XPYSyKd8P0ukMDpmiGAp3iphqSXwkTTeNcL2B21mQmOfO3iQ2JyIp2WA%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Set-Cookie: _cfuvid=FtMhTghC9.c6g6W9WdM7kUBOUmsTi6rmEdK9v5ALjp0-1706473450849-0-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
  • flag-us
    DNS
    233.134.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    233.134.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    68.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    16.234.44.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    16.234.44.23.in-addr.arpa
    IN PTR
    Response
    16.234.44.23.in-addr.arpa
    IN PTR
    a23-44-234-16deploystaticakamaitechnologiescom
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.160.77.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.160.77.104.in-addr.arpa
    IN PTR
    Response
    23.160.77.104.in-addr.arpa
    IN PTR
    a104-77-160-23deploystaticakamaitechnologiescom
  • flag-us
    DNS
    81.171.91.138.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    81.171.91.138.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    45.179.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    45.179.17.96.in-addr.arpa
    IN PTR
    Response
    45.179.17.96.in-addr.arpa
    IN PTR
    a96-17-179-45deploystaticakamaitechnologiescom
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    11.179.89.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.179.89.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    pradeepprabhu705.ddns.net
    D3E0800E550889AD45270980CA5D31D2.exe
    Remote address:
    8.8.8.8:53
    Request
    pradeepprabhu705.ddns.net
    IN A
    Response
    pradeepprabhu705.ddns.net
    IN A
    147.78.241.56
  • flag-us
    DNS
    56.241.78.147.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.241.78.147.in-addr.arpa
    IN PTR
    Response
  • 162.159.134.233:443
    https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat?ex=65b6f023&is=65a47b23&hm=d10599d908faa98f4e38c8fa05f7618af09346cf599dade55a0c93fb6feff152&
    tls, http
    D3E0800E550889AD45270980CA5D31D2.exe
    69.3kB
     2.5MB
     1308
    1899

    HTTP Request

    GET https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat?ex=65b6f023&is=65a47b23&hm=d10599d908faa98f4e38c8fa05f7618af09346cf599dade55a0c93fb6feff152&

    HTTP Response

    200
  • 147.78.241.56:313
    pradeepprabhu705.ddns.net
    tls
    D3E0800E550889AD45270980CA5D31D2.exe
    1.4kB
     2.0kB
     10
    8
  • 8.8.8.8:53
    61.179.17.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    61.179.17.96.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    cdn.discordapp.com
    dns
    D3E0800E550889AD45270980CA5D31D2.exe
    64 B
     144 B
     1
    1

    DNS Request

    cdn.discordapp.com

    DNS Response

    162.159.134.233
    162.159.133.233
    162.159.129.233
    162.159.130.233
    162.159.135.233

  • 8.8.8.8:53
    233.134.159.162.in-addr.arpa
    dns
    74 B
     136 B
     1
    1

    DNS Request

    233.134.159.162.in-addr.arpa

  • 8.8.8.8:53
    68.32.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    68.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    16.234.44.23.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    16.234.44.23.in-addr.arpa

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    23.160.77.104.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    23.160.77.104.in-addr.arpa

  • 8.8.8.8:53
    81.171.91.138.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    81.171.91.138.in-addr.arpa

  • 8.8.8.8:53
    45.179.17.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    45.179.17.96.in-addr.arpa

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    11.179.89.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    11.179.89.13.in-addr.arpa

  • 8.8.8.8:53
    pradeepprabhu705.ddns.net
    dns
    D3E0800E550889AD45270980CA5D31D2.exe
    71 B
     87 B
     1
    1

    DNS Request

    pradeepprabhu705.ddns.net

    DNS Response

    147.78.241.56

  • 8.8.8.8:53
    56.241.78.147.in-addr.arpa
    dns
    72 B
     143 B
     1
    1

    DNS Request

    56.241.78.147.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/812-0-0x0000000000330000-0x0000000000346000-memory.dmp

    Filesize

    88KB

    Download

  • memory/812-1-0x0000000074CB0000-0x0000000075460000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/812-2-0x0000000004D70000-0x0000000004D80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/812-3-0x00000000068F0000-0x0000000006B50000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/812-4-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-5-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-7-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-9-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-11-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-13-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-15-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-17-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-19-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-21-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-23-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-25-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-27-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-29-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-31-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-33-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-35-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-37-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-39-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-41-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-43-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-45-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-47-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-49-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-51-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-53-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-55-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-57-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-59-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-61-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-63-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-65-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-67-0x00000000068F0000-0x0000000006B49000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/812-936-0x0000000002630000-0x0000000002631000-memory.dmp

    Filesize

    4KB

    Download

  • memory/812-937-0x00000000070E0000-0x00000000072D6000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/812-938-0x0000000006DF0000-0x0000000006E3C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/812-939-0x0000000074CB0000-0x0000000075460000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/812-940-0x0000000004D70000-0x0000000004D80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/812-941-0x0000000007890000-0x0000000007E34000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/812-947-0x0000000074CB0000-0x0000000075460000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2552-948-0x0000000000400000-0x00000000007CE000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2552-950-0x0000000074BC0000-0x0000000074BF9000-memory.dmp

    Filesize

    228KB

    Download

  • memory/2552-958-0x0000000074F60000-0x0000000074F99000-memory.dmp

    Filesize

    228KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.