Resubmissions
09/04/2024, 03:49
240409-edcl2adf681009/04/2024, 03:48
240409-ec33ladf591009/04/2024, 03:47
240409-ecqr9sdf461009/04/2024, 03:47
240409-eb8xfshb7t1003/04/2024, 12:14
240403-peb21add4210Analysis
- max time kernel
1199s - max time network
1205s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
09/04/2024, 03:48
General
- Target Ezxotfkmz.exe
- Size 451KB
- Sample240409-ec33ladf59
- SHA256 89d511c97a4e0f4bf48a72fe764adb6d3de9007859c7632dc07477f2062c2b20
Malware Config
Extracted
-
bitrat
-
1.38
-
103.153.182.247:6161
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
install_dir
Install path
-
install_file
Install name
-
tor_process
tor
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- Detect ZGRat V1 34 IoCs
- XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
- ZGRat
ZGRat is remote access trojan written in C#.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Drops startup file 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: RenamesItself 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ezxotfkmz.exe"C:\Users\Admin\AppData\Local\Temp\Ezxotfkmz.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ezxotfkmz.exe"C:\Users\Admin\AppData\Local\Temp\Ezxotfkmz.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Install path\Install name-a "C:\Users\Admin\AppData\Local\ef307005\plg\gRrqgoBq.json"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\gRrqgoBq.exe-a "C:\Users\Admin\AppData\Local\ef307005\plg\gRrqgoBq.json"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gRrqgoBq.exe-a "C:\Users\Admin\AppData\Local\Temp\unk.xml"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Install name
License.XenArmor
License.XenArmor
Unknown.dll
gRrqgoBq.exe
unk.xml
memory/1328-5353-0x0000000000400000-0x00000000008DC000-memory.dmp
memory/1328-5356-0x0000000000400000-0x00000000008DC000-memory.dmp
memory/1328-5437-0x0000000000400000-0x00000000008DC000-memory.dmp
memory/2168-51-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-59-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-9-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-11-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-13-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-15-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-17-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-19-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-21-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-23-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-25-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-27-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-29-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-31-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-33-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-35-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-37-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-39-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-41-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-43-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-45-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-47-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-49-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-5-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-53-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-55-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-57-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-7-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-61-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-63-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-67-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-65-0x0000000006470000-0x000000000684F000-memory.dmp
memory/2168-1452-0x0000000075210000-0x00000000759C1000-memory.dmp
memory/2168-1624-0x0000000005BD0000-0x0000000005BE0000-memory.dmp
memory/2168-4886-0x0000000001660000-0x0000000001661000-memory.dmp
memory/2168-4887-0x0000000007B20000-0x0000000007D40000-memory.dmp
memory/2168-4888-0x0000000001A60000-0x0000000001AAC000-memory.dmp
memory/2168-4889-0x00000000082F0000-0x0000000008896000-memory.dmp
memory/2168-4890-0x0000000001AF0000-0x0000000001B44000-memory.dmp
memory/2168-4897-0x0000000075210000-0x00000000759C1000-memory.dmp
memory/2168-1-0x0000000075210000-0x00000000759C1000-memory.dmp
memory/2168-0-0x0000000000FF0000-0x0000000001066000-memory.dmp
memory/2168-2-0x0000000005BD0000-0x0000000005BE0000-memory.dmp
memory/2168-3-0x0000000006470000-0x0000000006854000-memory.dmp
memory/2168-4-0x0000000006470000-0x000000000684F000-memory.dmp
memory/4252-5385-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/4252-5390-0x0000000010000000-0x0000000010227000-memory.dmp
memory/4252-5408-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/4252-5409-0x0000000010000000-0x0000000010227000-memory.dmp
memory/4252-5382-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/4712-4900-0x0000000074F80000-0x0000000074FBC000-memory.dmp
memory/4712-4898-0x0000000000400000-0x00000000007CE000-memory.dmp
memory/4712-4908-0x0000000074BF0000-0x0000000074C2C000-memory.dmp
memory/4712-4920-0x0000000000400000-0x00000000007CE000-memory.dmp
memory/4712-4987-0x0000000074F80000-0x0000000074FBC000-memory.dmp
memory/4712-4988-0x0000000074BF0000-0x0000000074C2C000-memory.dmp