Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
02/07/2026, 23:04
General
- Target 2026-07-02_025b3c95498e8dff1d21e807c47be6fe_bitrat_coinminer_darkgate_elex_glassworm_luca-stealer_me.exe
- Size 7.8MB
- Sample260702-22dkkacz7m
- SHA256 7d5ed450cc0d92be8be16ad549e7901642f1def632fd26bad2c6280bffd0251f
Malware Config
Extracted
-
bitrat
-
1.34
-
wsec6nyzwgdwl33brnss72r6itx3lxtldugullkxqakre3bymruazzyd.onion:80
-
communication_password
944a53e776fade026ee3a640880a00f3
-
install_dir
xx
-
install_file
xxxx.exe
-
tor_process
video
Signatures
- Family: BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- Custom signatureUPX dump on OEP (original entry point) 64 IoCs
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 50 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: RenamesItself 27 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_025b3c95498e8dff1d21e807c47be6fe_bitrat_coinminer_darkgate_elex_glassworm_luca-stealer_me.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_025b3c95498e8dff1d21e807c47be6fe_bitrat_coinminer_darkgate_elex_glassworm_luca-stealer_me.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\66347ca6\tor\video.exe"C:\Users\Admin\AppData\Local\66347ca6\tor\video.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\66347ca6\tor\video.exe"C:\Users\Admin\AppData\Local\66347ca6\tor\video.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\66347ca6\tor\video.exe"C:\Users\Admin\AppData\Local\66347ca6\tor\video.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\66347ca6\tor\video.exe"C:\Users\Admin\AppData\Local\66347ca6\tor\video.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\66347ca6\tor\video.exe"C:\Users\Admin\AppData\Local\66347ca6\tor\video.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\66347ca6\tor\video.exe"C:\Users\Admin\AppData\Local\66347ca6\tor\video.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\xx\xxxx.exeC:\Users\Admin\AppData\Local\xx\xxxx.exe1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\66347ca6\tor\video.exe"C:\Users\Admin\AppData\Local\66347ca6\tor\video.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cached-certs
cached-certs
cached-microdesc-consensus
cached-microdescs
cached-microdescs.new
cached-microdescs.new
state
state
state
libcrypto-1_1.dll
libevent-2-1-6.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
torrc
video.exe
zlib1.dll
memory/1100-285-0x0000000073470000-0x000000007357A000-memory.dmp
memory/1100-270-0x0000000073310000-0x00000000733DE000-memory.dmp
memory/1100-280-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/1100-286-0x00000000733E0000-0x0000000073468000-memory.dmp
memory/1100-263-0x0000000073650000-0x000000007391F000-memory.dmp
memory/1100-264-0x0000000073580000-0x0000000073648000-memory.dmp
memory/1100-265-0x0000000074780000-0x00000000747C9000-memory.dmp
memory/1100-266-0x0000000073FD0000-0x0000000073FF4000-memory.dmp
memory/1100-281-0x0000000073650000-0x000000007391F000-memory.dmp
memory/1100-284-0x0000000073FD0000-0x0000000073FF4000-memory.dmp
memory/1100-283-0x0000000074780000-0x00000000747C9000-memory.dmp
memory/1100-267-0x0000000073470000-0x000000007357A000-memory.dmp
memory/1100-268-0x00000000733E0000-0x0000000073468000-memory.dmp
memory/1100-282-0x0000000073580000-0x0000000073648000-memory.dmp
memory/1100-295-0x0000000073310000-0x00000000733DE000-memory.dmp
memory/1100-287-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/1100-298-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/1100-307-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/1852-196-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/1852-162-0x0000000073580000-0x0000000073648000-memory.dmp
memory/1852-186-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/1852-194-0x0000000073650000-0x000000007391F000-memory.dmp
memory/1852-183-0x00000000734B0000-0x000000007357E000-memory.dmp
memory/1852-184-0x0000000073FD0000-0x0000000073FF4000-memory.dmp
memory/1852-182-0x0000000073580000-0x0000000073648000-memory.dmp
memory/1852-181-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/1852-214-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/1852-161-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/1852-163-0x00000000734B0000-0x000000007357E000-memory.dmp
memory/1852-164-0x0000000074780000-0x00000000747C9000-memory.dmp
memory/1852-165-0x0000000073FD0000-0x0000000073FF4000-memory.dmp
memory/1852-166-0x00000000733A0000-0x00000000734AA000-memory.dmp
memory/1852-168-0x0000000073650000-0x000000007391F000-memory.dmp
memory/1852-167-0x0000000073310000-0x0000000073398000-memory.dmp
memory/3184-1-0x0000000074070000-0x00000000740AB000-memory.dmp
memory/3184-205-0x0000000074070000-0x00000000740AB000-memory.dmp
memory/3184-348-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3184-134-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3184-339-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3184-125-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3184-322-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3184-204-0x00000000731E0000-0x000000007321B000-memory.dmp
memory/3184-153-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3184-296-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3184-297-0x0000000071F60000-0x0000000071F9B000-memory.dmp
memory/3184-366-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3184-371-0x00000000731E0000-0x000000007321B000-memory.dmp
memory/3184-46-0x0000000072E60000-0x0000000072E9B000-memory.dmp
memory/3184-93-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3184-279-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3184-49-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3184-252-0x0000000072E60000-0x0000000072E9B000-memory.dmp
memory/3184-185-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3184-224-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3184-195-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3184-0-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3708-126-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/3708-80-0x00000000732E0000-0x0000000073368000-memory.dmp
memory/3708-79-0x0000000073370000-0x000000007347A000-memory.dmp
memory/3708-144-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/3708-135-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/3708-75-0x0000000073580000-0x0000000073648000-memory.dmp
memory/3708-105-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/3708-98-0x0000000073650000-0x000000007391F000-memory.dmp
memory/3708-99-0x0000000073580000-0x0000000073648000-memory.dmp
memory/3708-78-0x0000000073480000-0x00000000734A4000-memory.dmp
memory/3708-100-0x00000000734B0000-0x000000007357E000-memory.dmp
memory/3708-94-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/3708-77-0x0000000073F90000-0x0000000073FD9000-memory.dmp
memory/3708-76-0x00000000734B0000-0x000000007357E000-memory.dmp
memory/3708-74-0x0000000073650000-0x000000007391F000-memory.dmp
memory/4452-233-0x0000000073580000-0x0000000073648000-memory.dmp
memory/4452-238-0x0000000073310000-0x0000000073398000-memory.dmp
memory/4452-232-0x0000000073650000-0x000000007391F000-memory.dmp
memory/4452-235-0x0000000074780000-0x00000000747C9000-memory.dmp
memory/4452-236-0x0000000073FD0000-0x0000000073FF4000-memory.dmp
memory/4452-247-0x0000000073310000-0x0000000073398000-memory.dmp
memory/4452-244-0x0000000074780000-0x00000000747C9000-memory.dmp
memory/4452-251-0x00000000733A0000-0x00000000734AA000-memory.dmp
memory/4452-237-0x00000000733A0000-0x00000000734AA000-memory.dmp
memory/4452-234-0x00000000734B0000-0x000000007357E000-memory.dmp
memory/4452-249-0x0000000073650000-0x000000007391F000-memory.dmp
memory/4452-248-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/4452-245-0x0000000073FD0000-0x0000000073FF4000-memory.dmp
memory/4452-250-0x0000000073580000-0x0000000073648000-memory.dmp
memory/4452-243-0x00000000734B0000-0x000000007357E000-memory.dmp
memory/4880-34-0x0000000073550000-0x000000007381F000-memory.dmp
memory/4880-52-0x0000000073820000-0x0000000073844000-memory.dmp
memory/4880-20-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/4880-31-0x0000000073850000-0x0000000073918000-memory.dmp
memory/4880-32-0x0000000073F90000-0x0000000073FD9000-memory.dmp
memory/4880-33-0x0000000073820000-0x0000000073844000-memory.dmp
memory/4880-48-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/4880-42-0x0000000073480000-0x000000007354E000-memory.dmp
memory/4880-43-0x0000000073370000-0x000000007347A000-memory.dmp
memory/4880-44-0x00000000732E0000-0x0000000073368000-memory.dmp
memory/4880-50-0x0000000073850000-0x0000000073918000-memory.dmp
memory/4880-53-0x0000000073550000-0x000000007381F000-memory.dmp
memory/4880-45-0x0000000000C70000-0x0000000000CF8000-memory.dmp
memory/4880-55-0x0000000000C70000-0x0000000000CF8000-memory.dmp
memory/4880-51-0x0000000073F90000-0x0000000073FD9000-memory.dmp
memory/4880-54-0x0000000073480000-0x000000007354E000-memory.dmp
memory/4880-58-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/5180-47-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/5180-56-0x0000000072E60000-0x0000000072E9B000-memory.dmp
memory/5424-375-0x0000000073580000-0x0000000073648000-memory.dmp
memory/5424-374-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/5424-377-0x0000000073FD0000-0x0000000073FF4000-memory.dmp
memory/5424-376-0x0000000073310000-0x00000000733DE000-memory.dmp
memory/5424-368-0x0000000073470000-0x000000007357A000-memory.dmp
memory/5424-370-0x0000000073650000-0x000000007391F000-memory.dmp
memory/5424-369-0x00000000733E0000-0x0000000073468000-memory.dmp
memory/5424-367-0x0000000074780000-0x00000000747C9000-memory.dmp
memory/5916-320-0x00000000733E0000-0x0000000073468000-memory.dmp
memory/5916-338-0x0000000073650000-0x000000007391F000-memory.dmp
memory/5916-340-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/5916-330-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/5916-349-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/5916-327-0x0000000073310000-0x00000000733DE000-memory.dmp
memory/5916-328-0x0000000073FD0000-0x0000000073FF4000-memory.dmp
memory/5916-329-0x0000000073470000-0x000000007357A000-memory.dmp
memory/5916-326-0x0000000073580000-0x0000000073648000-memory.dmp
memory/5916-325-0x0000000000820000-0x0000000000C24000-memory.dmp
memory/5916-316-0x0000000073580000-0x0000000073648000-memory.dmp
memory/5916-317-0x0000000073310000-0x00000000733DE000-memory.dmp
memory/5916-318-0x0000000074780000-0x00000000747C9000-memory.dmp
memory/5916-319-0x0000000073470000-0x000000007357A000-memory.dmp
memory/5916-321-0x0000000073650000-0x000000007391F000-memory.dmp