Resubmissions
26/04/2024, 06:45
240426-hh76aaba6t1026/04/2024, 06:44
240426-hh1q7sba5z1026/04/2024, 06:44
240426-hhztxaba5y1026/04/2024, 06:44
240426-hhy8daba951026/04/2024, 06:44
240426-hhylvaba941025/04/2024, 13:09
240425-qdtfbsba3y10Analysis
- max time kernel
147s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20240412-en - resource tags
- submitted
26/04/2024, 06:44
General
- Target 8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2.exe
- Size 11.7MB
- Sample240426-hhylvaba94
- SHA256 8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2
Malware Config
Extracted
-
bitrat
-
1.31
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- BitRAT payload 2 IoCs
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 22 IoCs
- UPX packed file 46 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2.exe"C:\Users\Admin\AppData\Local\Temp\8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe"C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe"C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe"C:\Users\Admin\AppData\Local\8123e463\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cached-certs
cached-microdesc-consensus
cached-microdescs
cached-microdescs.new
state
state
dllhost.exe
libcrypto-1_1.dll
libevent-2-1-6.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
torrc
zlib1.dll
memory/1972-161-0x0000000073530000-0x000000007356C000-memory.dmp
memory/1972-91-0x0000000074990000-0x00000000749CC000-memory.dmp
memory/1972-0-0x0000000000400000-0x0000000000FBD000-memory.dmp
memory/1972-62-0x0000000000400000-0x0000000000FBD000-memory.dmp
memory/1972-1-0x0000000074980000-0x00000000749BC000-memory.dmp
memory/1972-45-0x00000000734F0000-0x000000007352C000-memory.dmp
memory/3544-92-0x0000000000F70000-0x0000000001374000-memory.dmp
memory/3544-54-0x0000000000F70000-0x0000000001374000-memory.dmp
memory/3544-56-0x0000000073C00000-0x0000000073CC8000-memory.dmp
memory/3544-44-0x0000000073CD0000-0x0000000073F9F000-memory.dmp
memory/3544-63-0x0000000000F70000-0x0000000001374000-memory.dmp
memory/3544-64-0x0000000000F70000-0x0000000001374000-memory.dmp
memory/3544-72-0x0000000000F70000-0x0000000001374000-memory.dmp
memory/3544-83-0x0000000000F70000-0x0000000001374000-memory.dmp
memory/3544-41-0x0000000073AB0000-0x0000000073AD4000-memory.dmp
memory/3544-43-0x0000000073910000-0x0000000073A1A000-memory.dmp
memory/3544-101-0x0000000000F70000-0x0000000001374000-memory.dmp
memory/3544-109-0x0000000000F70000-0x0000000001374000-memory.dmp
memory/3544-33-0x0000000000F70000-0x0000000001374000-memory.dmp
memory/3544-38-0x0000000073B30000-0x0000000073BFE000-memory.dmp
memory/3544-39-0x0000000073AE0000-0x0000000073B29000-memory.dmp
memory/3544-37-0x0000000073C00000-0x0000000073CC8000-memory.dmp
memory/3544-40-0x0000000000AB0000-0x0000000000AF9000-memory.dmp
memory/3544-42-0x0000000073A20000-0x0000000073AA8000-memory.dmp
memory/3568-213-0x0000000073B30000-0x0000000073BFE000-memory.dmp
memory/3568-214-0x0000000073AE0000-0x0000000073B29000-memory.dmp
memory/3568-212-0x0000000073C00000-0x0000000073CC8000-memory.dmp
memory/3568-211-0x0000000073CD0000-0x0000000073F9F000-memory.dmp
memory/3568-215-0x0000000073910000-0x0000000073A1A000-memory.dmp
memory/3568-216-0x0000000073A20000-0x0000000073AA8000-memory.dmp
memory/3568-209-0x0000000000F70000-0x0000000001374000-memory.dmp
memory/3568-210-0x0000000073AB0000-0x0000000073AD4000-memory.dmp
memory/3736-137-0x0000000073CD0000-0x0000000073F9F000-memory.dmp
memory/3736-160-0x0000000000F70000-0x0000000001374000-memory.dmp
memory/3736-204-0x0000000000F70000-0x0000000001374000-memory.dmp
memory/3736-146-0x0000000073C00000-0x0000000073CC8000-memory.dmp
memory/3736-147-0x0000000073B30000-0x0000000073BFE000-memory.dmp
memory/3736-144-0x0000000000F70000-0x0000000001374000-memory.dmp
memory/3736-133-0x0000000073910000-0x0000000073A1A000-memory.dmp
memory/3736-134-0x0000000073A20000-0x0000000073AA8000-memory.dmp
memory/3736-130-0x0000000073AB0000-0x0000000073AD4000-memory.dmp
memory/3736-129-0x0000000073AE0000-0x0000000073B29000-memory.dmp
memory/3736-128-0x0000000073B30000-0x0000000073BFE000-memory.dmp
memory/3736-127-0x0000000073C00000-0x0000000073CC8000-memory.dmp
memory/3736-126-0x0000000000F70000-0x0000000001374000-memory.dmp