Resubmissions
26/04/2024, 06:45
240426-hh76aaba6t1026/04/2024, 06:44
240426-hh1q7sba5z1026/04/2024, 06:44
240426-hhztxaba5y1026/04/2024, 06:44
240426-hhy8daba951026/04/2024, 06:44
240426-hhylvaba941025/04/2024, 13:09
240425-qdtfbsba3y10Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
26/04/2024, 06:44
General
- Target 8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2.exe
- Size 11.7MB
- Sample240426-hhylvaba94
- SHA256 8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2
Malware Config
Extracted
-
bitrat
-
1.31
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- BitRAT payload 2 IoCs
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 22 IoCs
- UPX packed file 49 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2.exe"C:\Users\Admin\AppData\Local\Temp\8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe"C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe"C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe"C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cached-certs
cached-microdesc-consensus.tmp
cached-microdescs.new
cached-microdescs.new
state
dllhost.exe
libcrypto-1_1.dll
libevent-2-1-6.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
torrc
zlib1.dll
memory/208-165-0x0000000073E40000-0x000000007410F000-memory.dmp
memory/208-147-0x0000000000150000-0x0000000000554000-memory.dmp
memory/208-167-0x0000000000150000-0x0000000000554000-memory.dmp
memory/208-166-0x0000000073C20000-0x0000000073CE8000-memory.dmp
memory/208-155-0x0000000073D20000-0x0000000073D69000-memory.dmp
memory/208-161-0x0000000073B90000-0x0000000073C18000-memory.dmp
memory/208-151-0x0000000073C20000-0x0000000073CE8000-memory.dmp
memory/208-159-0x0000000073A80000-0x0000000073B8A000-memory.dmp
memory/208-158-0x0000000073CF0000-0x0000000073D14000-memory.dmp
memory/208-153-0x0000000073D70000-0x0000000073E3E000-memory.dmp
memory/208-149-0x0000000073E40000-0x000000007410F000-memory.dmp
memory/2296-45-0x0000000073750000-0x0000000073789000-memory.dmp
memory/2296-1-0x0000000074BC0000-0x0000000074BF9000-memory.dmp
memory/2296-59-0x0000000000400000-0x0000000000FBD000-memory.dmp
memory/2296-205-0x00000000736E0000-0x0000000073719000-memory.dmp
memory/2296-92-0x0000000074BE0000-0x0000000074C19000-memory.dmp
memory/2296-0-0x0000000000400000-0x0000000000FBD000-memory.dmp
memory/4756-40-0x0000000073C20000-0x0000000073CE8000-memory.dmp
memory/4756-41-0x0000000001CF0000-0x0000000001D39000-memory.dmp
memory/4756-101-0x0000000000150000-0x0000000000554000-memory.dmp
memory/4756-122-0x0000000000150000-0x0000000000554000-memory.dmp
memory/4756-93-0x0000000000150000-0x0000000000554000-memory.dmp
memory/4756-81-0x0000000000150000-0x0000000000554000-memory.dmp
memory/4756-72-0x0000000000150000-0x0000000000554000-memory.dmp
memory/4756-64-0x0000000000150000-0x0000000000554000-memory.dmp
memory/4756-148-0x0000000000150000-0x0000000000554000-memory.dmp
memory/4756-63-0x0000000000150000-0x0000000000554000-memory.dmp
memory/4756-49-0x0000000073E40000-0x000000007410F000-memory.dmp
memory/4756-48-0x0000000000150000-0x0000000000554000-memory.dmp
memory/4756-44-0x0000000073D70000-0x0000000073E3E000-memory.dmp
memory/4756-43-0x0000000073A80000-0x0000000073B8A000-memory.dmp
memory/4756-42-0x0000000073B90000-0x0000000073C18000-memory.dmp
memory/4756-109-0x0000000000150000-0x0000000000554000-memory.dmp
memory/4756-34-0x0000000073E40000-0x000000007410F000-memory.dmp
memory/4756-19-0x0000000000150000-0x0000000000554000-memory.dmp
memory/4756-38-0x0000000073D20000-0x0000000073D69000-memory.dmp
memory/4756-39-0x0000000073CF0000-0x0000000073D14000-memory.dmp
memory/4784-182-0x0000000073BF0000-0x0000000073C78000-memory.dmp
memory/4784-177-0x0000000073E10000-0x0000000073ED8000-memory.dmp
memory/4784-188-0x0000000073EE0000-0x00000000741AF000-memory.dmp
memory/4784-183-0x0000000073B20000-0x0000000073BEE000-memory.dmp
memory/4784-189-0x0000000073DC0000-0x0000000073E09000-memory.dmp
memory/4784-181-0x0000000073C80000-0x0000000073D8A000-memory.dmp
memory/4784-206-0x0000000000150000-0x0000000000554000-memory.dmp
memory/4784-207-0x0000000073E10000-0x0000000073ED8000-memory.dmp
memory/4784-216-0x0000000073D90000-0x0000000073DB4000-memory.dmp
memory/4784-217-0x0000000073B20000-0x0000000073BEE000-memory.dmp
memory/4784-180-0x0000000073D90000-0x0000000073DB4000-memory.dmp