Resubmissions
17/04/2024, 11:59
240417-n55assfe711017/04/2024, 11:59
240417-n5yg9afe7x1017/04/2024, 11:59
240417-n5rdyaea361017/04/2024, 11:59
240417-n5qseaea351017/04/2024, 11:59
240417-n5p6wafe6y1017/04/2024, 06:14
240417-gzcv2aff7510Analysis
- max time kernel
297s - max time network
299s - platform
windows11-21h2_x64 - resource
win11-20240412-en - resource tags
- submitted
17/04/2024, 06:14
General
- Target 426bc8bac5cb97b5340b0f347cc70024fb5cc64041149ad923c815aedaf17a7a.exe
- Size 7.8MB
- Sample240417-gzcv2aff75
- SHA256 426bc8bac5cb97b5340b0f347cc70024fb5cc64041149ad923c815aedaf17a7a
Malware Config
Extracted
-
bitrat
-
1.38
-
sef7qgz77oamhl5gimls62lekmig5ormf6dcgftblhaxt2cn7emkbuid.onion:80
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
install_dir
appdata
-
install_file
HealthCheck.exe
-
tor_process
WebDebugger
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 35 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: RenamesItself 58 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\426bc8bac5cb97b5340b0f347cc70024fb5cc64041149ad923c815aedaf17a7a.exe"C:\Users\Admin\AppData\Local\Temp\426bc8bac5cb97b5340b0f347cc70024fb5cc64041149ad923c815aedaf17a7a.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\00e31655\tor\WebDebugger.exe"C:\Users\Admin\AppData\Local\00e31655\tor\WebDebugger.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\00e31655\tor\WebDebugger.exe"C:\Users\Admin\AppData\Local\00e31655\tor\WebDebugger.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\00e31655\tor\WebDebugger.exe"C:\Users\Admin\AppData\Local\00e31655\tor\WebDebugger.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\00e31655\tor\WebDebugger.exe"C:\Users\Admin\AppData\Local\00e31655\tor\WebDebugger.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\00e31655\tor\WebDebugger.exe"C:\Users\Admin\AppData\Local\00e31655\tor\WebDebugger.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
WebDebugger.exe
cached-certs
cached-microdesc-consensus
cached-microdescs
cached-microdescs.new
cached-microdescs.new
state
state
state
state
libcrypto-1_1.dll
libevent-2-1-6.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
torrc
zlib1.dll
memory/660-189-0x0000000073640000-0x000000007390F000-memory.dmp
memory/660-158-0x0000000073540000-0x0000000073564000-memory.dmp
memory/660-163-0x00000000734B0000-0x0000000073538000-memory.dmp
memory/660-159-0x00000000733A0000-0x00000000734AA000-memory.dmp
memory/660-153-0x0000000073640000-0x000000007390F000-memory.dmp
memory/660-157-0x0000000073910000-0x0000000073959000-memory.dmp
memory/660-156-0x0000000073570000-0x000000007363E000-memory.dmp
memory/660-155-0x0000000073960000-0x0000000073A28000-memory.dmp
memory/660-152-0x0000000000150000-0x0000000000554000-memory.dmp
memory/660-225-0x0000000000150000-0x0000000000554000-memory.dmp
memory/660-191-0x0000000073570000-0x000000007363E000-memory.dmp
memory/660-190-0x0000000073960000-0x0000000073A28000-memory.dmp
memory/660-188-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1004-264-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1004-265-0x0000000073640000-0x000000007390F000-memory.dmp
memory/1004-244-0x00000000734B0000-0x0000000073538000-memory.dmp
memory/1004-242-0x0000000073540000-0x0000000073564000-memory.dmp
memory/1004-235-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1004-243-0x00000000733A0000-0x00000000734AA000-memory.dmp
memory/1004-239-0x0000000073960000-0x0000000073A28000-memory.dmp
memory/1004-240-0x0000000073570000-0x000000007363E000-memory.dmp
memory/1004-236-0x0000000073640000-0x000000007390F000-memory.dmp
memory/1004-241-0x0000000073910000-0x0000000073959000-memory.dmp
memory/1004-313-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1272-52-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1272-38-0x0000000073570000-0x000000007363E000-memory.dmp
memory/1272-127-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1272-31-0x0000000073910000-0x0000000073959000-memory.dmp
memory/1272-119-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1272-111-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1272-103-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1272-154-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1272-94-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1272-69-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1272-53-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1272-20-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1272-46-0x0000000073910000-0x0000000073959000-memory.dmp
memory/1272-44-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1272-37-0x0000000073640000-0x000000007390F000-memory.dmp
memory/1272-39-0x0000000073540000-0x0000000073564000-memory.dmp
memory/1272-41-0x0000000073960000-0x0000000073A28000-memory.dmp
memory/1272-42-0x00000000734B0000-0x0000000073538000-memory.dmp
memory/1272-40-0x00000000733A0000-0x00000000734AA000-memory.dmp
memory/1488-316-0x0000000073640000-0x000000007390F000-memory.dmp
memory/1488-344-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1488-347-0x0000000073570000-0x000000007363E000-memory.dmp
memory/1488-346-0x0000000073960000-0x0000000073A28000-memory.dmp
memory/1488-345-0x0000000073640000-0x000000007390F000-memory.dmp
memory/1488-383-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1488-323-0x00000000733A0000-0x00000000734AA000-memory.dmp
memory/1488-317-0x0000000073960000-0x0000000073A28000-memory.dmp
memory/1488-324-0x00000000734B0000-0x0000000073538000-memory.dmp
memory/1488-320-0x0000000073570000-0x000000007363E000-memory.dmp
memory/1488-322-0x0000000073540000-0x0000000073564000-memory.dmp
memory/1488-321-0x0000000073910000-0x0000000073959000-memory.dmp
memory/1488-315-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1964-398-0x0000000073640000-0x000000007390F000-memory.dmp
memory/1964-399-0x0000000073960000-0x0000000073A28000-memory.dmp
memory/1964-396-0x0000000000150000-0x0000000000554000-memory.dmp
memory/1964-401-0x0000000073540000-0x0000000073564000-memory.dmp
memory/1964-402-0x00000000733A0000-0x00000000734AA000-memory.dmp
memory/1964-400-0x0000000073910000-0x0000000073959000-memory.dmp
memory/1964-403-0x00000000734B0000-0x0000000073538000-memory.dmp
memory/1964-397-0x0000000073570000-0x000000007363E000-memory.dmp
memory/3856-343-0x0000000072FB0000-0x0000000072FEC000-memory.dmp
memory/3856-1-0x0000000074400000-0x000000007443C000-memory.dmp
memory/3856-348-0x00000000743E0000-0x000000007441C000-memory.dmp
memory/3856-43-0x0000000073060000-0x000000007309C000-memory.dmp
memory/3856-187-0x0000000072FB0000-0x0000000072FEC000-memory.dmp
memory/3856-102-0x00000000743E0000-0x000000007441C000-memory.dmp
memory/3856-0-0x0000000000400000-0x0000000000BDB000-memory.dmp
memory/3856-284-0x0000000073060000-0x000000007309C000-memory.dmp
memory/3856-275-0x0000000074400000-0x000000007443C000-memory.dmp
memory/3856-266-0x0000000072FB0000-0x0000000072FEC000-memory.dmp