Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
05/02/2024, 02:02
General
-
Target
STUB.exe
-
Size
3.8MB
-
MD5
08b8d6d55fa0ab4034e2080270e83fdb
-
SHA1
4fba6fa6251f41e381588335e7b73c77765149f9
-
SHA256
f0c2e55ec391d428f5f79b270bc770f5c684414becd8d2c7f0c8fb78462b47bb
-
SHA512
83ff113311596c16c8f6192ce7b1e03125327f225d9734074508ea9a4925e897ea6b5afbb648434082bf5d058ed442bb5993f057be407282ec20e5e6613a2beb
-
SSDEEP
98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/DmlwXVZ4FB:5+R/eZADUXR
Score
10/10
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
Cluluvsu-34807.portmap.host:34807
Attributes
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
install_dir
sdudir
-
install_file
sudir
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
Adds Run key to start application 2 TTPs 7 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Suspicious behavior: RenamesItself 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\STUB.exe"C:\Users\Admin\AppData\Local\Temp\STUB.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB