Overview

overview

10

Static

static

10

bdd9e7f08c...93.exe

windows7-x64

10

bdd9e7f08c...93.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-02-2024 13:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bdd9e7f08c0201a33241054eba30df948f4712463d306879a3f40ed4e82d2d93.exe

  • Size

    3.8MB

  • MD5

    9601fd942d9f38ebb7908a390be2d485

  • SHA1

    fd5778d86dc0af782533abee1711a89be58e1c35

  • SHA256

    bdd9e7f08c0201a33241054eba30df948f4712463d306879a3f40ed4e82d2d93

  • SHA512

    55e90810c9cc7fe5018ab60d0f68a2cd0653665e5cc6501d2c69b42779495f17e9ed30da45a99a8675398e67eb6a4ba80390da48e784a31dfdb96b88f6d19c06

  • SSDEEP

    98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/JmlwXVZ4FB:5+R/eZADUXR

Score
10/10
bitrattrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

backu4734.duckdns.org:7904

Attributes
  • communication_password

    202cb962ac59075b964b07152d234b70

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bdd9e7f08c0201a33241054eba30df948f4712463d306879a3f40ed4e82d2d93.exe
    "C:\Users\Admin\AppData\Local\Temp\bdd9e7f08c0201a33241054eba30df948f4712463d306879a3f40ed4e82d2d93.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4112-0-0x0000000000400000-0x00000000007CE000-memory.dmp
    Filesize

    3.8MB

    Download
  • memory/4112-1-0x00000000747A0000-0x00000000747D9000-memory.dmp
    Filesize

    228KB

    Download
  • memory/4112-2-0x0000000074B20000-0x0000000074B59000-memory.dmp
    Filesize

    228KB

    Download
  • memory/4112-3-0x0000000074B20000-0x0000000074B59000-memory.dmp
    Filesize

    228KB

    Download
  • memory/4112-4-0x0000000074B20000-0x0000000074B59000-memory.dmp
    Filesize

    228KB

    Download
  • memory/4112-5-0x0000000074B20000-0x0000000074B59000-memory.dmp
    Filesize

    228KB

    Download
  • memory/4112-6-0x0000000074B20000-0x0000000074B59000-memory.dmp
    Filesize

    228KB

    Download
  • memory/4112-7-0x0000000074B20000-0x0000000074B59000-memory.dmp
    Filesize

    228KB

    Download
  • memory/4112-8-0x0000000074B20000-0x0000000074B59000-memory.dmp
    Filesize

    228KB

    Download
  • memory/4112-9-0x0000000074B20000-0x0000000074B59000-memory.dmp
    Filesize

    228KB

    Download
  • memory/4112-10-0x0000000074B20000-0x0000000074B59000-memory.dmp
    Filesize

    228KB

    Download