Analysis
- max time kernel
116s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
20/09/2024, 09:55
General
- Target 0a99a8953769de42b0a9673ed1e8003793b5228a225f4b8a5d7a3f2c80fb1146N.exe
- Size 7.8MB
- Sample240920-lx49qa1bpp
- SHA256 0a99a8953769de42b0a9673ed1e8003793b5228a225f4b8a5d7a3f2c80fb1146
Malware Config
Extracted
-
bitrat
-
1.35
-
hijy62t5b43fhu3dblgep4drtoqjpfi7jgxqaectce2verypcui3qbad.onion:80
-
communication_password
202cb962ac59075b964b07152d234b70
-
install_dir
mucro
-
install_file
micro.exe
-
tor_process
mschostw
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 30 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: RenamesItself 22 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a99a8953769de42b0a9673ed1e8003793b5228a225f4b8a5d7a3f2c80fb1146N.exe"C:\Users\Admin\AppData\Local\Temp\0a99a8953769de42b0a9673ed1e8003793b5228a225f4b8a5d7a3f2c80fb1146N.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\1cdfb2fa\tor\mschostw.exe"C:\Users\Admin\AppData\Local\1cdfb2fa\tor\mschostw.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\1cdfb2fa\tor\mschostw.exe"C:\Users\Admin\AppData\Local\1cdfb2fa\tor\mschostw.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\1cdfb2fa\tor\mschostw.exe"C:\Users\Admin\AppData\Local\1cdfb2fa\tor\mschostw.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\1cdfb2fa\tor\mschostw.exe"C:\Users\Admin\AppData\Local\1cdfb2fa\tor\mschostw.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cached-certs
cached-microdesc-consensus.tmp
cached-microdescs
cached-microdescs.new
cached-microdescs.new
state
state
state
libcrypto-1_1.dll
libevent-2-1-6.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
mschostw.exe
torrc
zlib1.dll
memory/464-30-0x0000000074370000-0x0000000074438000-memory.dmp
memory/464-40-0x0000000073E90000-0x000000007415F000-memory.dmp
memory/464-18-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/464-32-0x0000000074340000-0x0000000074364000-memory.dmp
memory/464-38-0x0000000074160000-0x000000007426A000-memory.dmp
memory/464-55-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/464-39-0x0000000073E00000-0x0000000073E88000-memory.dmp
memory/464-62-0x0000000074340000-0x0000000074364000-memory.dmp
memory/464-61-0x0000000074370000-0x0000000074438000-memory.dmp
memory/464-60-0x0000000074440000-0x0000000074489000-memory.dmp
memory/464-37-0x0000000074270000-0x000000007433E000-memory.dmp
memory/464-68-0x0000000074270000-0x000000007433E000-memory.dmp
memory/464-77-0x0000000074160000-0x000000007426A000-memory.dmp
memory/464-78-0x0000000073E90000-0x000000007415F000-memory.dmp
memory/464-87-0x0000000001630000-0x00000000018FF000-memory.dmp
memory/464-79-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/464-42-0x0000000001630000-0x00000000018FF000-memory.dmp
memory/464-95-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/464-41-0x0000000001900000-0x0000000001988000-memory.dmp
memory/464-104-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/464-121-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/464-24-0x0000000074440000-0x0000000074489000-memory.dmp
memory/1068-248-0x00000000742A0000-0x00000000742E9000-memory.dmp
memory/1068-258-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/1068-247-0x00000000742F0000-0x00000000743BE000-memory.dmp
memory/1068-259-0x00000000743C0000-0x0000000074488000-memory.dmp
memory/1068-249-0x0000000074270000-0x0000000074294000-memory.dmp
memory/1068-250-0x0000000073E90000-0x0000000073F9A000-memory.dmp
memory/1068-251-0x0000000073FA0000-0x000000007426F000-memory.dmp
memory/1068-263-0x0000000073FA0000-0x000000007426F000-memory.dmp
memory/1068-262-0x0000000073E90000-0x0000000073F9A000-memory.dmp
memory/1068-261-0x0000000074270000-0x0000000074294000-memory.dmp
memory/1068-252-0x0000000073E00000-0x0000000073E88000-memory.dmp
memory/1068-246-0x00000000743C0000-0x0000000074488000-memory.dmp
memory/1068-260-0x00000000742F0000-0x00000000743BE000-memory.dmp
memory/1408-208-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/1408-196-0x0000000073E90000-0x0000000073F9A000-memory.dmp
memory/1408-206-0x00000000740F0000-0x00000000741B8000-memory.dmp
memory/1408-205-0x00000000741C0000-0x000000007448F000-memory.dmp
memory/1408-204-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/1408-237-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/1408-197-0x0000000073E00000-0x0000000073E88000-memory.dmp
memory/1408-207-0x0000000074020000-0x00000000740EE000-memory.dmp
memory/1408-195-0x0000000073FA0000-0x0000000073FC4000-memory.dmp
memory/1408-194-0x0000000073FD0000-0x0000000074019000-memory.dmp
memory/1408-193-0x0000000074020000-0x00000000740EE000-memory.dmp
memory/1408-192-0x00000000740F0000-0x00000000741B8000-memory.dmp
memory/1408-183-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/1408-191-0x00000000741C0000-0x000000007448F000-memory.dmp
memory/2000-131-0x00000000741C0000-0x000000007448F000-memory.dmp
memory/2000-130-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/2000-137-0x0000000073E00000-0x0000000073E88000-memory.dmp
memory/2000-136-0x0000000073E90000-0x0000000073F9A000-memory.dmp
memory/2000-163-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/2000-154-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/2000-151-0x00000000741C0000-0x000000007448F000-memory.dmp
memory/2000-152-0x00000000740F0000-0x00000000741B8000-memory.dmp
memory/2000-135-0x0000000073FA0000-0x0000000073FC4000-memory.dmp
memory/2000-134-0x0000000073FD0000-0x0000000074019000-memory.dmp
memory/2000-153-0x0000000074020000-0x00000000740EE000-memory.dmp
memory/2000-150-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/2000-133-0x0000000074020000-0x00000000740EE000-memory.dmp
memory/2000-181-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/2000-132-0x00000000740F0000-0x00000000741B8000-memory.dmp
memory/2600-0-0x0000000074F40000-0x0000000074F79000-memory.dmp
memory/2600-149-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/2600-226-0x00000000739F0000-0x0000000073A29000-memory.dmp
memory/2600-216-0x0000000074F40000-0x0000000074F79000-memory.dmp
memory/2600-171-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/2600-203-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/2600-103-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/2600-94-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/2600-59-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/2600-54-0x00000000739F0000-0x0000000073A29000-memory.dmp