Analysis
-
max time kernel
106s -
max time network
107s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
-
submitted
17-02-2024 23:54
General
-
Target
stub_tor.exe
-
Size
7.8MB
-
MD5
b30606fcc4649c057f26005617816fe3
-
SHA1
0b1d5b6a70402bb3865a7bdc8afc50f44c308c63
-
SHA256
875237641d591cc1fe90e3bcac9a63000fe52366a0ece16728becd34d5b5752e
-
SHA512
0a3ed3ded1f23b930b7758f40d9b4438de39eca69926f19253f03ec68d8b9b022d0fe3a5b44feb10159bd0c969aca6620097f7355c66b08559297591e25b7658
-
SSDEEP
196608:oIRcbH4jSteTGvlxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:odHsfulxwZ6v1CPwDv3uFteg2EeJUO9E
Malware Config
Extracted
bitrat
1.38
7sbl4dpbubwjjghdquwg47fyq7rookd4bgm2ypm2kjzkivd7tomvczqd.onion:80
-
communication_password
4124bc0a9335c27f086f24ba207a4912
-
install_dir
cold
-
install_file
Runtime_Broker
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 23 IoCs
-
UPX packed file 47 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 5 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: RenamesItself 19 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\stub_tor.exe"C:\Users\Admin\AppData\Local\Temp\stub_tor.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\db6ca74f\tor\tor.exe"C:\Users\Admin\AppData\Local\db6ca74f\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\db6ca74f\tor\tor.exe"C:\Users\Admin\AppData\Local\db6ca74f\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\db6ca74f\tor\tor.exe"C:\Users\Admin\AppData\Local\db6ca74f\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5c1aae28f6dfde7dce20da53868979a08
SHA1d8d7812b1338f547d7d345c805ea034e0fe814fa
SHA256b00dd88fcd9fb26a3afda2e652ed830950d0315371065ede6a7eff9aef77c330
SHA512d4fae8f55d86526b702a1390d231a2624bdcb032089d58126ba168cc33a61885a02dd677da21a5e19c23ba92075db4a66e6a60621af998dc3c1138ec67e45deb
-
Filesize
20KB
MD501cc7b62b272f9df8a6da7af63a27070
SHA162acc79a155e95f0ac22b4d1002ce2310a590cf2
SHA2565582b21124b12dedc5878c44af11e1b13ee420a3a0456258b4c42c57634bbbf7
SHA512d1b5129bf3c4f58e0405e1f7dd8654082a999c51a338bb839f3a2b3733e5c252d4ed8e4413d475d6e40e209c49713d891673ac751b38c4692497e159c15d9ce8
-
Filesize
2.6MB
MD51d0e7e383ca56c8ad4bca066cfa3f45f
SHA18ac8c6524d0f0d5653c9a08336bcf68b8a9f1c8f
SHA256c84886c0416cc99f58be9105ff56a7345786f25c8f4c1ac3b9ac3a4c7e2540cd
SHA512ddd1c781ab689ea29588e7983853d5fa25737813b84f4cb06cf3859ef76b3ad98d01962d146ca92cbfd7013291aa83b61ddda7bd7aae0f668552e19565047810
-
Filesize
10.9MB
MD5f3f97be4bc07f96ae39925531a7ceea4
SHA1c090d1158bc05532838bd0278c54db1c92b250ca
SHA256f8d8621b22e8affa563e3ab7a7f585c09dd461553d15eef80a7891183156907f
SHA5124d8adde20f02c77430cca2828c154eda89b50eed2a2f0dba59d3bcef02675144d774f757b282afabab1773ef13e45b103cca054fa15420a79a474966ff0f29b1
-
Filesize
9.4MB
MD5e49a311ae928bb2fc519ffb6b093f64b
SHA1f3934274a71ccb12b185b0489f8e5f454f1b5cca
SHA256e4a5202d262d0c81cf7202a8b5d83be6dd84db16b4631f0b300ff66445de16fe
SHA512187203068879d1547a19d86511577d21abfe5694a732bfbf71c1c1bd378559513cc5fb8112b90fffa7a8c559e91ecbf472f918f2ee324a2ff3c90c57c73ab076
-
Filesize
232B
MD554b13d673bcc4b2191adda5c9a576d9a
SHA1eb4c948498cc4acebf15da65fb13d590dab10a91
SHA2561ac1d0656b8c66bf6d65046efe8942eea7967e2e1a4372b9d507e972ca71e985
SHA512ab85e83d7f66fdbd7650c4dea5c896f630b4598b8ac487029f25a437f14a8313638dc68c5e0b4a6653cb3f2aba1a52dbf754c409fc94e9bf938403603c14fc63
-
Filesize
1.7MB
MD52384a02c4a1f7ec481adde3a020607d3
SHA17e848d35a10bf9296c8fa41956a3daa777f86365
SHA256c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369
SHA5121ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503
-
Filesize
366KB
MD5099983c13bade9554a3c17484e5481f1
SHA1a84e69ad9722f999252d59d0ed9a99901a60e564
SHA256b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838
SHA51289f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2
-
Filesize
286KB
MD5b0d98f7157d972190fe0759d4368d320
SHA15715a533621a2b642aad9616e603c6907d80efc4
SHA2562922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5
SHA51241ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496
-
Filesize
439KB
MD5c88826ac4bb879622e43ead5bdb95aeb
SHA187d29853649a86f0463bfd9ad887b85eedc21723
SHA256c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f
SHA512f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3
-
Filesize
88KB
MD52c916456f503075f746c6ea649cf9539
SHA1fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
SHA256cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
SHA5121c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd
-
Filesize
188KB
MD5d407cc6d79a08039a6f4b50539e560b8
SHA121171adbc176dc19aaa5e595cd2cd4bd1dfd0c71
SHA25692cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e
SHA512378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c
-
Filesize
973KB
MD55cfe61ff895c7daa889708665ef05d7b
SHA15e58efe30406243fbd58d4968b0492ddeef145f2
SHA256f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5
SHA51243b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da
-
Filesize
157B
MD5f695271007d045c22270f23f7166b828
SHA1f599b938da9cd9e31ffa5cd64ce947e2418fbe02
SHA256edb5397c9683c75323e117fd7365770400656b652a2c139d5e8503cbf90983ad
SHA512cf92301892d77fc25b08e972851efdb74b561f3b2267ee9b8acf6c1853f608a901e64c7b6662352cc04ab831e9522cc2de5f1d286378bca3c4d23bb2954e040e
-
Filesize
52KB
MD5add33041af894b67fe34e1dc819b7eb6
SHA16db46eb021855a587c95479422adcc774a272eeb
SHA2568688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa
-
Filesize
240KB
-
Filesize
7.8MB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
292KB
-
Filesize
4.0MB
-
Filesize
2.8MB
-
Filesize
4.0MB
-
Filesize
824KB
-
Filesize
800KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
292KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
824KB
-
Filesize
1.0MB
-
Filesize
4.0MB
-
Filesize
144KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
800KB
-
Filesize
544KB
-
Filesize
4.0MB
-
Filesize
800KB
-
Filesize
824KB
-
Filesize
144KB
-
Filesize
1.0MB
-
Filesize
2.8MB
-
Filesize
800KB
-
Filesize
544KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
292KB
-
Filesize
2.8MB
-
Filesize
292KB
-
Filesize
144KB
-
Filesize
2.8MB
-
Filesize
824KB
-
Filesize
544KB
-
Filesize
1.0MB
-
Filesize
4.0MB
-
Filesize
800KB