Resubmissions
26/04/2024, 06:45
240426-hh76aaba6t1026/04/2024, 06:44
240426-hh1q7sba5z1026/04/2024, 06:44
240426-hhztxaba5y1026/04/2024, 06:44
240426-hhy8daba951026/04/2024, 06:44
240426-hhylvaba941025/04/2024, 13:09
240425-qdtfbsba3y10Analysis
- max time kernel
146s - max time network
150s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
26/04/2024, 06:44
General
- Target 8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2.exe
- Size 11.7MB
- Sample240426-hhylvaba94
- SHA256 8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2
Malware Config
Extracted
-
bitrat
-
1.31
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- BitRAT payload 2 IoCs
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 25 IoCs
- UPX packed file 52 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2.exe"C:\Users\Admin\AppData\Local\Temp\8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe"C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe"C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe"C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cached-certs
cached-microdesc-consensus.tmp
state
libcrypto-1_1.dll
libevent-2-1-6.dll
libssp-0.dll
torrc
dllhost.exe
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libwinpthread-1.dll
zlib1.dll
memory/572-169-0x00000000738C0000-0x000000007398E000-memory.dmp
memory/572-198-0x00000000738C0000-0x000000007398E000-memory.dmp
memory/572-163-0x0000000073E10000-0x0000000073F1A000-memory.dmp
memory/572-195-0x0000000073A50000-0x0000000073D1F000-memory.dmp
memory/572-197-0x0000000073F20000-0x0000000073FE8000-memory.dmp
memory/572-194-0x0000000000290000-0x0000000000694000-memory.dmp
memory/572-196-0x0000000074230000-0x0000000074279000-memory.dmp
memory/572-193-0x0000000073E10000-0x0000000073F1A000-memory.dmp
memory/572-167-0x00000000742A0000-0x00000000742C4000-memory.dmp
memory/572-166-0x0000000073D80000-0x0000000073E08000-memory.dmp
memory/572-162-0x0000000073F20000-0x0000000073FE8000-memory.dmp
memory/572-161-0x0000000074230000-0x0000000074279000-memory.dmp
memory/572-160-0x0000000073A50000-0x0000000073D1F000-memory.dmp
memory/572-159-0x0000000000290000-0x0000000000694000-memory.dmp
memory/1404-119-0x0000000074320000-0x0000000074344000-memory.dmp
memory/1404-109-0x0000000074280000-0x00000000742C9000-memory.dmp
memory/1404-117-0x0000000073A70000-0x0000000073B3E000-memory.dmp
memory/1404-115-0x00000000741F0000-0x0000000074278000-memory.dmp
memory/1404-114-0x0000000074280000-0x00000000742C9000-memory.dmp
memory/1404-113-0x0000000073B40000-0x0000000073C4A000-memory.dmp
memory/1404-112-0x0000000073D20000-0x0000000073FEF000-memory.dmp
memory/1404-111-0x0000000073C50000-0x0000000073D18000-memory.dmp
memory/1404-106-0x0000000000DC0000-0x00000000011C4000-memory.dmp
memory/1404-107-0x0000000073D20000-0x0000000073FEF000-memory.dmp
memory/1404-110-0x0000000000DC0000-0x00000000011C4000-memory.dmp
memory/1988-158-0x0000000004F20000-0x0000000005324000-memory.dmp
memory/1988-53-0x0000000000400000-0x0000000000FBD000-memory.dmp
memory/1988-18-0x00000000044E0000-0x00000000048E4000-memory.dmp
memory/1988-54-0x00000000044E0000-0x00000000048E4000-memory.dmp
memory/1988-28-0x00000000044E0000-0x00000000048E4000-memory.dmp
memory/1988-168-0x0000000004F20000-0x0000000005324000-memory.dmp
memory/1988-105-0x0000000004F20000-0x0000000005324000-memory.dmp
memory/1988-0-0x0000000000400000-0x0000000000FBD000-memory.dmp
memory/1988-55-0x00000000044E0000-0x00000000048E4000-memory.dmp
memory/2712-46-0x0000000073D20000-0x0000000073FEF000-memory.dmp
memory/2712-40-0x0000000073B40000-0x0000000073C4A000-memory.dmp
memory/2712-47-0x0000000074280000-0x00000000742C9000-memory.dmp
memory/2712-48-0x0000000073C50000-0x0000000073D18000-memory.dmp
memory/2712-56-0x0000000000DC0000-0x00000000011C4000-memory.dmp
memory/2712-45-0x0000000000DC0000-0x00000000011C4000-memory.dmp
memory/2712-64-0x0000000000DC0000-0x00000000011C4000-memory.dmp
memory/2712-44-0x0000000074320000-0x0000000074344000-memory.dmp
memory/2712-43-0x0000000073A70000-0x0000000073B3E000-memory.dmp
memory/2712-51-0x0000000073A70000-0x0000000073B3E000-memory.dmp
memory/2712-38-0x0000000000DC0000-0x00000000011C4000-memory.dmp
memory/2712-36-0x0000000073C50000-0x0000000073D18000-memory.dmp
memory/2712-37-0x00000000741F0000-0x0000000074278000-memory.dmp
memory/2712-32-0x0000000074280000-0x00000000742C9000-memory.dmp
memory/2712-31-0x0000000073D20000-0x0000000073FEF000-memory.dmp
memory/2712-72-0x0000000000DC0000-0x00000000011C4000-memory.dmp
memory/2712-89-0x0000000000DC0000-0x00000000011C4000-memory.dmp