Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29-02-2024 07:36

General

  • Target

    29abe8d57ceedbd2a15a8b8fa36afe274d18c7f586714640435d090d43e4711f.exe

  • Size

    3.8MB

  • MD5

    8130bd163d4185237ef67b74dddb8a45

  • SHA1

    d92751ebd2b99eb2102a4ec68b1b0be4a1fb6f54

  • SHA256

    29abe8d57ceedbd2a15a8b8fa36afe274d18c7f586714640435d090d43e4711f

  • SHA512

    14f67e103ff0a20f098b9b414c63615ba2e1a67c6ebe491fe9ca1def3e45c5f9c80aadc9c49860eaf51f8e9d44467df5543828ef7a2698d870d84e4609bf5720

  • SSDEEP

    98304:K77Pmq33rE/JDLPWZADUGer7B6iY74M/PmlwXVZ4FB:8+R/eZADUXR

Score
10/10

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

194.5.98.46:1180

Attributes
  • communication_password

    c5b2cebf15b205503560c4e8e6d1ea78

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29abe8d57ceedbd2a15a8b8fa36afe274d18c7f586714640435d090d43e4711f.exe
    "C:\Users\Admin\AppData\Local\Temp\29abe8d57ceedbd2a15a8b8fa36afe274d18c7f586714640435d090d43e4711f.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2240-0-0x0000000000400000-0x00000000007CE000-memory.dmp
    Filesize

    3.8MB