Resubmissions
26/04/2024, 06:45
240426-hh76aaba6t1026/04/2024, 06:44
240426-hh1q7sba5z1026/04/2024, 06:44
240426-hhztxaba5y1026/04/2024, 06:44
240426-hhy8daba951026/04/2024, 06:44
240426-hhylvaba941025/04/2024, 13:09
240425-qdtfbsba3y10Analysis
- max time kernel
149s - max time network
157s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
26/04/2024, 06:44
General
- Target 8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2.exe
- Size 11.7MB
- Sample240426-hhylvaba94
- SHA256 8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2
Malware Config
Extracted
-
bitrat
-
1.31
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- BitRAT payload 2 IoCs
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 24 IoCs
- UPX packed file 49 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2.exe"C:\Users\Admin\AppData\Local\Temp\8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe"C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe"C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe"C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cached-certs
cached-microdesc-consensus.tmp
state
dllhost.exe
libcrypto-1_1.dll
libevent-2-1-6.dll
torrc
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
zlib1.dll
memory/2136-82-0x0000000001370000-0x0000000001774000-memory.dmp
memory/2136-117-0x0000000001370000-0x0000000001774000-memory.dmp
memory/2136-37-0x0000000072600000-0x0000000072688000-memory.dmp
memory/2136-38-0x0000000001280000-0x0000000001308000-memory.dmp
memory/2136-35-0x0000000072960000-0x0000000072984000-memory.dmp
memory/2136-41-0x0000000001780000-0x0000000001A4F000-memory.dmp
memory/2136-43-0x0000000072BC0000-0x0000000072C8E000-memory.dmp
memory/2136-42-0x0000000072690000-0x000000007295F000-memory.dmp
memory/2136-34-0x0000000072990000-0x0000000072A9A000-memory.dmp
memory/2136-31-0x0000000001370000-0x0000000001774000-memory.dmp
memory/2136-45-0x0000000001370000-0x0000000001774000-memory.dmp
memory/2136-48-0x0000000072AA0000-0x0000000072B68000-memory.dmp
memory/2136-52-0x0000000072690000-0x000000007295F000-memory.dmp
memory/2136-153-0x0000000001370000-0x0000000001774000-memory.dmp
memory/2136-54-0x0000000001370000-0x0000000001774000-memory.dmp
memory/2136-62-0x0000000001370000-0x0000000001774000-memory.dmp
memory/2136-63-0x0000000001280000-0x0000000001308000-memory.dmp
memory/2136-64-0x0000000001780000-0x0000000001A4F000-memory.dmp
memory/2136-65-0x0000000001370000-0x0000000001774000-memory.dmp
memory/2136-73-0x0000000001370000-0x0000000001774000-memory.dmp
memory/2136-33-0x0000000072AA0000-0x0000000072B68000-memory.dmp
memory/2136-32-0x0000000072B70000-0x0000000072BB9000-memory.dmp
memory/2136-90-0x0000000001370000-0x0000000001774000-memory.dmp
memory/2136-98-0x0000000001370000-0x0000000001774000-memory.dmp
memory/2940-176-0x0000000072CF0000-0x0000000072DB8000-memory.dmp
memory/2940-209-0x0000000072CF0000-0x0000000072DB8000-memory.dmp
memory/2940-200-0x0000000001370000-0x0000000001774000-memory.dmp
memory/2940-179-0x0000000072BE0000-0x0000000072CEA000-memory.dmp
memory/2940-183-0x0000000001D40000-0x0000000001DC8000-memory.dmp
memory/2940-187-0x0000000072DC0000-0x000000007308F000-memory.dmp
memory/2940-186-0x0000000072A80000-0x0000000072B4E000-memory.dmp
memory/2940-182-0x0000000072B50000-0x0000000072BD8000-memory.dmp
memory/2940-178-0x0000000073560000-0x0000000073584000-memory.dmp
memory/2940-177-0x0000000073590000-0x00000000735D9000-memory.dmp
memory/3196-146-0x0000000072990000-0x0000000072A9A000-memory.dmp
memory/3196-144-0x0000000072960000-0x0000000072984000-memory.dmp
memory/3196-162-0x0000000072BC0000-0x0000000072C8E000-memory.dmp
memory/3196-161-0x0000000072AA0000-0x0000000072B68000-memory.dmp
memory/3196-160-0x0000000001370000-0x0000000001774000-memory.dmp
memory/3196-151-0x0000000072690000-0x000000007295F000-memory.dmp
memory/3196-140-0x0000000072AA0000-0x0000000072B68000-memory.dmp
memory/3196-138-0x0000000001370000-0x0000000001774000-memory.dmp
memory/3196-143-0x0000000072B70000-0x0000000072BB9000-memory.dmp
memory/3196-163-0x0000000072960000-0x0000000072984000-memory.dmp
memory/3196-149-0x0000000072600000-0x0000000072688000-memory.dmp
memory/3196-142-0x0000000072BC0000-0x0000000072C8E000-memory.dmp
memory/4512-44-0x0000000072330000-0x000000007236A000-memory.dmp
memory/4512-1-0x00000000735A0000-0x00000000735DA000-memory.dmp
memory/4512-0-0x0000000000400000-0x0000000000FBD000-memory.dmp
memory/4512-199-0x00000000727E0000-0x000000007281A000-memory.dmp
memory/4512-53-0x0000000000400000-0x0000000000FBD000-memory.dmp
memory/4512-81-0x0000000072EA0000-0x0000000072EDA000-memory.dmp