Resubmissions
26/04/2024, 06:45
240426-hh76aaba6t1026/04/2024, 06:44
240426-hh1q7sba5z1026/04/2024, 06:44
240426-hhztxaba5y1026/04/2024, 06:44
240426-hhy8daba951026/04/2024, 06:44
240426-hhylvaba941025/04/2024, 13:09
240425-qdtfbsba3y10Analysis
- max time kernel
150s - max time network
157s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
26/04/2024, 06:44
General
- Target 8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2.exe
- Size 11.7MB
- Sample240426-hhylvaba94
- SHA256 8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2
Malware Config
Extracted
-
bitrat
-
1.31
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- BitRAT payload 2 IoCs
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 22 IoCs
- UPX packed file 49 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2.exe"C:\Users\Admin\AppData\Local\Temp\8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe"C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe"C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe"C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cached-certs
cached-microdesc-consensus.tmp
cached-microdescs.new
state
dllhost.exe
libcrypto-1_1.dll
torrc
zlib1.dll
libevent-2-1-6.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
memory/2648-158-0x0000000073310000-0x00000000733D8000-memory.dmp
memory/2648-136-0x0000000073310000-0x00000000733D8000-memory.dmp
memory/2648-159-0x0000000073240000-0x000000007330E000-memory.dmp
memory/2648-157-0x0000000000D90000-0x0000000001194000-memory.dmp
memory/2648-156-0x00000000731C0000-0x00000000731E4000-memory.dmp
memory/2648-140-0x00000000731F0000-0x0000000073239000-memory.dmp
memory/2648-149-0x0000000072D50000-0x000000007301F000-memory.dmp
memory/2648-146-0x0000000073130000-0x00000000731B8000-memory.dmp
memory/2648-144-0x0000000073020000-0x000000007312A000-memory.dmp
memory/2648-142-0x00000000731C0000-0x00000000731E4000-memory.dmp
memory/2648-138-0x0000000073240000-0x000000007330E000-memory.dmp
memory/3020-52-0x0000000000D90000-0x0000000001194000-memory.dmp
memory/3020-35-0x0000000073020000-0x000000007312A000-memory.dmp
memory/3020-33-0x00000000731C0000-0x00000000731E4000-memory.dmp
memory/3020-61-0x0000000000D90000-0x0000000001194000-memory.dmp
memory/3020-69-0x0000000000D90000-0x0000000001194000-memory.dmp
memory/3020-77-0x0000000000D90000-0x0000000001194000-memory.dmp
memory/3020-28-0x0000000000D90000-0x0000000001194000-memory.dmp
memory/3020-86-0x0000000000D90000-0x0000000001194000-memory.dmp
memory/3020-98-0x0000000000D90000-0x0000000001194000-memory.dmp
memory/3020-106-0x0000000000D90000-0x0000000001194000-memory.dmp
memory/3020-114-0x0000000000D90000-0x0000000001194000-memory.dmp
memory/3020-31-0x0000000073240000-0x000000007330E000-memory.dmp
memory/3020-50-0x0000000072D50000-0x000000007301F000-memory.dmp
memory/3020-45-0x0000000073240000-0x000000007330E000-memory.dmp
memory/3020-43-0x0000000000D90000-0x0000000001194000-memory.dmp
memory/3020-147-0x0000000000D90000-0x0000000001194000-memory.dmp
memory/3020-36-0x0000000072D50000-0x000000007301F000-memory.dmp
memory/3020-34-0x0000000073130000-0x00000000731B8000-memory.dmp
memory/3020-41-0x0000000073310000-0x00000000733D8000-memory.dmp
memory/3020-32-0x00000000731F0000-0x0000000073239000-memory.dmp
memory/3020-40-0x0000000001E60000-0x000000000212F000-memory.dmp
memory/3384-197-0x0000000072F30000-0x0000000072F6A000-memory.dmp
memory/3384-42-0x0000000072A60000-0x0000000072A9A000-memory.dmp
memory/3384-0-0x0000000000400000-0x0000000000FBD000-memory.dmp
memory/3384-1-0x0000000073CF0000-0x0000000073D2A000-memory.dmp
memory/3384-51-0x0000000000400000-0x0000000000FBD000-memory.dmp
memory/3384-85-0x00000000735F0000-0x000000007362A000-memory.dmp
memory/4912-172-0x0000000073440000-0x0000000073508000-memory.dmp
memory/4912-181-0x0000000073370000-0x000000007343E000-memory.dmp
memory/4912-175-0x0000000073260000-0x000000007336A000-memory.dmp
memory/4912-180-0x00000000731D0000-0x0000000073258000-memory.dmp
memory/4912-173-0x0000000073CE0000-0x0000000073D29000-memory.dmp
memory/4912-174-0x0000000073CB0000-0x0000000073CD4000-memory.dmp
memory/4912-171-0x0000000073510000-0x00000000737DF000-memory.dmp
memory/4912-198-0x0000000000D90000-0x0000000001194000-memory.dmp
memory/4912-207-0x0000000073510000-0x00000000737DF000-memory.dmp
memory/4912-208-0x0000000073440000-0x0000000073508000-memory.dmp