Analysis
-
max time kernel
154s -
max time network
166s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29-02-2024 10:39
General
-
Target
94644247e987a89b4597900e155b0091f2cbd27ea6ddedef3c7b82d2ed4f616f.exe
-
Size
3.8MB
-
MD5
1067928dcbd36e9bf33bd93467b7e950
-
SHA1
dca092869448f09c8a3892df86796568727084dc
-
SHA256
94644247e987a89b4597900e155b0091f2cbd27ea6ddedef3c7b82d2ed4f616f
-
SHA512
26dcfee0a4f80a53c50c9a1e1462c5c83da4e4c715905fc532013681709ca654f737281e023b7163d2eea529a910ba7966bff80a00d5ef876871c0bf3df3b5ee
-
SSDEEP
98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/0mlwXVZ4FB:5+R/eZADUXR
Score
10/10
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
51.89.205.208:5506
Attributes
-
communication_password
99b410aa504a6f67da128d333896ecd4
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\94644247e987a89b4597900e155b0091f2cbd27ea6ddedef3c7b82d2ed4f616f.exe"C:\Users\Admin\AppData\Local\Temp\94644247e987a89b4597900e155b0091f2cbd27ea6ddedef3c7b82d2ed4f616f.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1640-0-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB