Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
24/05/2026, 01:43
General
- Target sub_2150dbdddb2a.exe
- Size 5.0MB
- Sample260524-b5bbhaet2m
- SHA256 2150dbdddb2a234bcf8f52b5c4019a6d75bcf34e6d9bee760eb27a126f5da3f7
Malware Config
Extracted
-
bitrat
-
M220211
-
z59okz.duckdns.org:5223
-
communication_password
04bbfc692698503fc45a9b88f682cddf
-
install_dir
jvapwut
-
install_file
zpfuthj.exe
-
tor_process
tor
Signatures
- Family: BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Themida packer 37 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 6 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: RenamesItself 30 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sub_2150dbdddb2a.exe"C:\Users\Admin\AppData\Local\Temp\sub_2150dbdddb2a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\jvapwut\zpfuthj.exeC:\Users\Admin\AppData\Local\jvapwut\zpfuthj.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4232-13-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4232-25-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4232-26-0x0000000074A40000-0x0000000074A7C000-memory.dmp
memory/4232-22-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4232-20-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4232-21-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4232-19-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4232-18-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4232-16-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4232-17-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4232-15-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4232-14-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-11-0x0000000074B20000-0x0000000074B5C000-memory.dmp
memory/4420-29-0x0000000074A40000-0x0000000074A7C000-memory.dmp
memory/4420-0-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-10-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-2-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-5-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-9-0x0000000000D3A000-0x0000000000D3B000-memory.dmp
memory/4420-8-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-7-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-6-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-3-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-23-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-24-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-4-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-1-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-27-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-28-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-12-0x0000000074A40000-0x0000000074A7C000-memory.dmp
memory/4420-30-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-31-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-32-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-33-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-34-0x0000000074A40000-0x0000000074A7C000-memory.dmp
memory/4420-35-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-36-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-37-0x0000000074B20000-0x0000000074B5C000-memory.dmp
memory/4420-38-0x0000000074A40000-0x0000000074A7C000-memory.dmp
memory/4420-39-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-40-0x0000000074A40000-0x0000000074A7C000-memory.dmp
memory/4420-41-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-42-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-43-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-44-0x00000000009B0000-0x0000000001540000-memory.dmp
memory/4420-45-0x0000000074A40000-0x0000000074A7C000-memory.dmp
memory/4420-46-0x00000000009B0000-0x0000000001540000-memory.dmp