Analysis

  • max time kernel
    153s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-02-2024 08:54

General

  • Target

    50527e91d9639320bdee5ea73daa63a83b68dbc7c247102ea71a8f42e6ab6008.exe

  • Size

    3.8MB

  • MD5

    9d458156b9496d5e0060e20cfb7b96d4

  • SHA1

    7a3736d2f7aaa3d2c072a0ec801aaf92541a47b6

  • SHA256

    50527e91d9639320bdee5ea73daa63a83b68dbc7c247102ea71a8f42e6ab6008

  • SHA512

    86edd37bde9ede3a1023a0b2e1288e0315e98245ae5980a4580af64302ff45eeda7f107009757b2e12e9ba5ba886ee479d20ecacda004a39d2ce279ec61e43f4

  • SSDEEP

    98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/PmlwXVZ4FB:5+R/eZADUXR

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

nig.jalenscoonwog.info:2222

Attributes
  • communication_password

    cd83bad852692fc9d8682ff467c46dc7

  • install_dir

    Zen Studios

  • install_file

    Zen Studios.exe

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious behavior: RenamesItself 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\50527e91d9639320bdee5ea73daa63a83b68dbc7c247102ea71a8f42e6ab6008.exe
    "C:\Users\Admin\AppData\Local\Temp\50527e91d9639320bdee5ea73daa63a83b68dbc7c247102ea71a8f42e6ab6008.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4292

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4292-0-0x0000000000400000-0x00000000007CE000-memory.dmp
    Filesize

    3.8MB

  • memory/4292-1-0x0000000075010000-0x0000000075049000-memory.dmp
    Filesize

    228KB

  • memory/4292-2-0x0000000074F80000-0x0000000074FB9000-memory.dmp
    Filesize

    228KB

  • memory/4292-3-0x0000000074F80000-0x0000000074FB9000-memory.dmp
    Filesize

    228KB

  • memory/4292-4-0x0000000074F80000-0x0000000074FB9000-memory.dmp
    Filesize

    228KB

  • memory/4292-5-0x0000000074F80000-0x0000000074FB9000-memory.dmp
    Filesize

    228KB

  • memory/4292-6-0x0000000074F80000-0x0000000074FB9000-memory.dmp
    Filesize

    228KB

  • memory/4292-7-0x0000000074F80000-0x0000000074FB9000-memory.dmp
    Filesize

    228KB

  • memory/4292-8-0x0000000074F80000-0x0000000074FB9000-memory.dmp
    Filesize

    228KB

  • memory/4292-9-0x0000000074F80000-0x0000000074FB9000-memory.dmp
    Filesize

    228KB

  • memory/4292-10-0x0000000074F80000-0x0000000074FB9000-memory.dmp
    Filesize

    228KB

  • memory/4292-11-0x0000000074F80000-0x0000000074FB9000-memory.dmp
    Filesize

    228KB

  • memory/4292-12-0x0000000074F80000-0x0000000074FB9000-memory.dmp
    Filesize

    228KB