bitrat | a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449

Resubmissions

07-05-2024 12:28

240507-pnhadaac95 10

07-05-2024 12:28

07-05-2024 12:28

07-05-2024 12:28

07-05-2024 12:28

25-04-2024 13:10

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Size

7.8MB
MD5

feb61ffde2dd829e738ea35dc8ee6208
SHA1

659e17fe8390c0494e1363c2ebd11333638fd56e
SHA256

a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449
SHA512

609d2a7950643bea16e353d73157429f304cd1807808becb6fd2c5bbeeb07c6583a98f0e76b7e051390771502cabc7bbda4360f53388867ab863c6f564fbd959
SSDEEP

196608:oIRcbH4jSteTGv1xwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:odHsfu1xwZ6v1CPwDv3uFteg2EeJUO9E

Score

10^/10

bitrat persistence trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

n7dua2r7ev3r6fsisszycs7fvy4a36epnfje5s7lz5eiduoxetqg55ad.onion:1235

Attributes

communication_password
99754106633f94d350db34d548d6091a
install_dir
temp
install_file
test1
tor_process
test2

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

ACProtect 1.3x - 1.4x DLL software 7 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\d46500b0\tor\libcrypto-1_1.dll	acprotect
C:\Users\Admin\AppData\Local\d46500b0\tor\libssp-0.dll	acprotect
C:\Users\Admin\AppData\Local\d46500b0\tor\libevent-2-1-6.dll	acprotect
C:\Users\Admin\AppData\Local\d46500b0\tor\libwinpthread-1.dll	acprotect
C:\Users\Admin\AppData\Local\d46500b0\tor\libssl-1_1.dll	acprotect
C:\Users\Admin\AppData\Local\d46500b0\tor\zlib1.dll	acprotect
\Users\Admin\AppData\Local\d46500b0\tor\libgcc_s_sjlj-1.dll	acprotect

Executes dropped EXE 4 IoCs

Processes:

test2.exetest2.exetest2.exetest2.exe

pid process

2148 test2.exe
2336 test2.exe
2948 test2.exe
2840 test2.exe

pid	process
2148	test2.exe
2336	test2.exe
2948	test2.exe
2840	test2.exe

Loads dropped DLL 33 IoCs

Processes:

a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exetest2.exetest2.exetest2.exetest2.exe

pid	process
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2148	test2.exe
2148	test2.exe
2148	test2.exe
2148	test2.exe
2148	test2.exe
2148	test2.exe
2148	test2.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2336	test2.exe
2336	test2.exe
2336	test2.exe
2336	test2.exe
2336	test2.exe
2336	test2.exe
2336	test2.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2948	test2.exe
2948	test2.exe
2948	test2.exe
2948	test2.exe
2948	test2.exe
2948	test2.exe
2948	test2.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2840	test2.exe
2840	test2.exe
2840	test2.exe
2840	test2.exe
2840	test2.exe
2840	test2.exe
2840	test2.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\d46500b0\tor\test2.exe	upx
behavioral2/memory/2052-17-0x0000000004000000-0x0000000004404000-memory.dmp	upx
C:\Users\Admin\AppData\Local\d46500b0\tor\libcrypto-1_1.dll	upx
behavioral2/memory/2148-21-0x00000000000D0000-0x00000000004D4000-memory.dmp	upx
C:\Users\Admin\AppData\Local\d46500b0\tor\libssp-0.dll	upx
C:\Users\Admin\AppData\Local\d46500b0\tor\libevent-2-1-6.dll	upx
C:\Users\Admin\AppData\Local\d46500b0\tor\libwinpthread-1.dll	upx
C:\Users\Admin\AppData\Local\d46500b0\tor\libssl-1_1.dll	upx
C:\Users\Admin\AppData\Local\d46500b0\tor\zlib1.dll	upx
behavioral2/memory/2148-40-0x0000000073D50000-0x0000000073E1E000-memory.dmp	upx
behavioral2/memory/2148-41-0x0000000074A20000-0x0000000074A44000-memory.dmp	upx
behavioral2/memory/2148-36-0x0000000073E20000-0x0000000073EA8000-memory.dmp	upx
behavioral2/memory/2148-33-0x0000000073EB0000-0x0000000073FBA000-memory.dmp	upx
behavioral2/memory/2148-32-0x00000000744B0000-0x0000000074578000-memory.dmp	upx
\Users\Admin\AppData\Local\d46500b0\tor\libgcc_s_sjlj-1.dll	upx
behavioral2/memory/2148-26-0x0000000074580000-0x00000000745C9000-memory.dmp	upx
behavioral2/memory/2148-25-0x0000000073FC0000-0x000000007428F000-memory.dmp	upx
behavioral2/memory/2148-47-0x00000000000D0000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/2148-48-0x0000000073FC0000-0x000000007428F000-memory.dmp	upx
behavioral2/memory/2148-49-0x00000000000D0000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/2148-55-0x0000000073D50000-0x0000000073E1E000-memory.dmp	upx
behavioral2/memory/2148-54-0x0000000073E20000-0x0000000073EA8000-memory.dmp	upx
behavioral2/memory/2148-53-0x0000000073EB0000-0x0000000073FBA000-memory.dmp	upx
behavioral2/memory/2148-52-0x00000000744B0000-0x0000000074578000-memory.dmp	upx
behavioral2/memory/2148-51-0x0000000074580000-0x00000000745C9000-memory.dmp	upx
behavioral2/memory/2148-58-0x00000000000D0000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/2148-79-0x00000000000D0000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/2148-89-0x00000000000D0000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/2148-98-0x00000000000D0000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/2336-127-0x00000000745A0000-0x00000000745C4000-memory.dmp	upx
behavioral2/memory/2336-128-0x00000000000D0000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/2336-126-0x0000000073FE0000-0x00000000740AE000-memory.dmp	upx
behavioral2/memory/2336-125-0x00000000744A0000-0x0000000074528000-memory.dmp	upx
behavioral2/memory/2336-124-0x00000000740B0000-0x00000000741BA000-memory.dmp	upx
behavioral2/memory/2336-123-0x00000000741C0000-0x0000000074288000-memory.dmp	upx
behavioral2/memory/2336-122-0x0000000074530000-0x0000000074579000-memory.dmp	upx
behavioral2/memory/2336-121-0x0000000073CF0000-0x0000000073FBF000-memory.dmp	upx
behavioral2/memory/2052-120-0x0000000004C60000-0x0000000005064000-memory.dmp	upx
behavioral2/memory/2336-150-0x00000000741C0000-0x0000000074288000-memory.dmp	upx
behavioral2/memory/2336-153-0x0000000073FE0000-0x00000000740AE000-memory.dmp	upx
behavioral2/memory/2336-148-0x0000000073CF0000-0x0000000073FBF000-memory.dmp	upx
behavioral2/memory/2336-147-0x00000000000D0000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/2336-161-0x00000000000D0000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/2052-179-0x0000000000BE0000-0x0000000000BEA000-memory.dmp	upx
behavioral2/memory/2336-205-0x00000000000D0000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/2948-229-0x0000000074550000-0x0000000074574000-memory.dmp	upx
behavioral2/memory/2948-228-0x0000000073EF0000-0x0000000073FBE000-memory.dmp	upx
behavioral2/memory/2948-227-0x0000000074200000-0x0000000074288000-memory.dmp	upx
behavioral2/memory/2948-226-0x0000000073FE0000-0x00000000740EA000-memory.dmp	upx
behavioral2/memory/2948-225-0x00000000740F0000-0x00000000741B8000-memory.dmp	upx
behavioral2/memory/2948-224-0x00000000744E0000-0x0000000074529000-memory.dmp	upx
behavioral2/memory/2948-223-0x00000000731D0000-0x000000007349F000-memory.dmp	upx
behavioral2/memory/2948-220-0x00000000000D0000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/2948-259-0x00000000000D0000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/2948-260-0x00000000731D0000-0x000000007349F000-memory.dmp	upx
behavioral2/memory/2948-289-0x00000000000D0000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/2052-295-0x0000000005AC0000-0x0000000005EC4000-memory.dmp	upx
behavioral2/memory/2840-313-0x0000000072E70000-0x000000007313F000-memory.dmp	upx
behavioral2/memory/2840-312-0x0000000074500000-0x0000000074524000-memory.dmp	upx
behavioral2/memory/2840-311-0x00000000732C0000-0x000000007338E000-memory.dmp	upx
behavioral2/memory/2840-310-0x0000000074130000-0x00000000741B8000-memory.dmp	upx
behavioral2/memory/2840-309-0x0000000073390000-0x000000007349A000-memory.dmp	upx
behavioral2/memory/2840-307-0x0000000074020000-0x00000000740E8000-memory.dmp	upx
behavioral2/memory/2840-305-0x0000000074240000-0x0000000074289000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\test1 = "C:\\Users\\Admin\\AppData\\Local\\temp\\test1"	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 myexternalip.com
20 myexternalip.com
34 myexternalip.com

flow	ioc
19	myexternalip.com
20	myexternalip.com
34	myexternalip.com

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe

pid	process
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe

Suspicious behavior: RenamesItself 28 IoCs

Processes:

a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe

pid	process
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe

description	pid	process
Token: SeDebugPrivilege	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Token: SeShutdownPrivilege	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe

pid process

2052 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
2052 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe

description	pid	process	target process
PID 2052 wrote to memory of 2148	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe
PID 2052 wrote to memory of 2148	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe
PID 2052 wrote to memory of 2148	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe
PID 2052 wrote to memory of 2148	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe
PID 2052 wrote to memory of 2336	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe
PID 2052 wrote to memory of 2336	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe
PID 2052 wrote to memory of 2336	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe
PID 2052 wrote to memory of 2336	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe
PID 2052 wrote to memory of 2948	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe
PID 2052 wrote to memory of 2948	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe
PID 2052 wrote to memory of 2948	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe
PID 2052 wrote to memory of 2948	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe
PID 2052 wrote to memory of 2840	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe
PID 2052 wrote to memory of 2840	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe
PID 2052 wrote to memory of 2840	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe
PID 2052 wrote to memory of 2840	2052	a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe	test2.exe

C:\Users\Admin\AppData\Local\Temp\a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
"C:\Users\Admin\AppData\Local\Temp\a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052

C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe
"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148

C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe
"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336

C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe
"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948

C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe
"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\d46500b0\tor\data\cached-certs
Filesize
20KB

MD5
f16e5c7e94620165f8a95d088e8a9081

SHA1
7bd75e8c1fbf5de04f2740f16ddc800bc206a4dd

SHA256
f758324bb62582d5d142314dc4e3d324ea30cd93fa627689ca3891fec0b6d2f8

SHA512
890f3f5ea06296ef02b5cd263c26ec7187927c070bf133ef8fff7e895ccb89bb41cce4a8ac131af06d4b09cf0cb57c41331913616c5c3de3f248279656f90208

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\data\cached-microdesc-consensus.tmp
Filesize
2.4MB

MD5
0ce4530144899e61e7151afe7810919f

SHA1
f300561ff8bbd2b426926aced1e576bd2b91d001

SHA256
59f1410ba288f348e46546682bc8ae589accfdb2abc49b0b59fed35ed9de32e5

SHA512
595a94b645837f8627b703920cec6eda3e6103ae964c91c383679f00b712343b7f8d4656db6efdaceabe8c641cf45d6461ff77cc9fafa263880bc1a0763a83e6

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\data\cached-microdescs
Filesize
5.1MB

MD5
ac87b84bcb8d8734d72587dd6d86cba6

SHA1
e5a9017ddf7dcc9db5218e736bc212bf7bb62520

SHA256
f46ae5316facd896b2a556b77773a80dc469cc1d7dab9bca39a97f00fd6ef531

SHA512
3667e8a7f4450e8ade06d46bfa3cffbcfe8d373ea26d8ffe877f4949f47f49c5ab4bc03451f008c02a49bfc51411ec63a8c9274fce88e4a0e452e36f4653fe63

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\data\cached-microdescs.new
Filesize
5.1MB

MD5
98a26515988b7c3c310efdc4433d92cc

SHA1
420384524eaae5e7fe05451e23253b103b5ec91d

SHA256
536634d2456cd69f078f57191aa7f65cea47b98e7812a6b6e8d5e23f7fc224b0

SHA512
bae51a706674017d00b126418cbd696e378e86e3a9fb2ef12a6fefe71261ce20f63059fc741a1fc4365e2c626d859bd73d0cabc493d677f6787a8e7bc44dc9dc

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\data\cached-microdescs.new
Filesize
6.3MB

MD5
d8e824ab211f751aaa05b1300f60aa81

SHA1
143efb4293afa189584ed2f4b62d379f9254b8ff

SHA256
729463208c17589439bc198ec6d0ead5288df831beb190750e5cf56b89a2b042

SHA512
1c76d774b68579a1b644946cf332910ce87ddfd9f2a43f49bc54810727471d40d0b62045575478bf96ce54930520f5f6f08e4bd72ece6270b26d71b6dd091776

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\data\cached-microdescs.new
Filesize
12.6MB

MD5
997f1adef7365489f2e9d663f91b7f46

SHA1
89ea20560e086b608f017af91351fc3e0e560b9f

SHA256
c7bb985650e54e52f42f3d53c81b9c56c26b226b61a38d762a51658add621c05

SHA512
f1705dfdb93a6197a7924eb618cf96e1ed6072b935d162e583304a70234f817684a3a3f865767772c23d0d86bee49864f30716630e9302c3b273ca1b2698e83e

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\data\cached-microdescs.new
Filesize
9.1MB

MD5
3e0d20f28e2f31e8c8d2694ad5b72791

SHA1
492f611f8494c75b03cf43b2210b96c9c751c2a0

SHA256
6d5f7d6d4e85f333197b10197952bd1a56f34b72a53b3f59d6625202bd52a82a

SHA512
df7946f0e065b10a90fa200feda2c4a0ebd3e02b5de11055d2a53fb1ffcf70a17360008f59118fbf6be135bf45e89b42263c93e4a3ac353eb780701a70d6ac4a

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\data\state
Filesize
232B

MD5
5c1762600cce241bfc93fd92628e0c22

SHA1
1a6cc241b07197f3fa3fb150bc7d99d7c63f8059

SHA256
75f6a5312b23c8a172111054a66fb49c125f051d2410cd958f342ae1522a20bf

SHA512
92dc043082edd20b083b2327657aeacf1ca07c582b11d0a343f72abc20ec1e59f420bd0a71dba59e734f3e6f8bc2a5dbfa1ba6b41637a81ebd732bee76b3ea8e

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\data\state
Filesize
3KB

MD5
2a10ae3e2ab4d2bb6f16fa7807975406

SHA1
6b5503f1c73b54c0a5ec39041589b85c1c55dbbf

SHA256
13ce2cbf7f1801d116d630ae2a2736fc02e16bc751c52432f8098f51b6fd19e7

SHA512
0b31456c8759656ed8d408202a42713e17a4ccec62edbeab97539582bdf637d97c29f772dfd75107bd12e995dd9cb15a628a686403f79a892931a0860eb7a9da

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\data\state
Filesize
5KB

MD5
3dfdfc6c07261c75ae63938c003b5eeb

SHA1
42e00c282186dce0ca8be68a85c59b3945dae5af

SHA256
5470ffe5d9af401d9b64348484af4354861fe62fe2215d8cade45ee9e279a8e5

SHA512
edfb4cf0be4da7a29b9b47e2d53756fd50e2e27cb9b417e04041c7e09f47df9b69d182f3b1613a96f841f688cfac008b65fa29047cd7e455963cbb94ffc604b9

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\libcrypto-1_1.dll
Filesize
1.7MB

MD5
2384a02c4a1f7ec481adde3a020607d3

SHA1
7e848d35a10bf9296c8fa41956a3daa777f86365

SHA256
c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369

SHA512
1ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\libevent-2-1-6.dll
Filesize
366KB

MD5
099983c13bade9554a3c17484e5481f1

SHA1
a84e69ad9722f999252d59d0ed9a99901a60e564

SHA256
b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838

SHA512
89f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\libssl-1_1.dll
Filesize
439KB

MD5
c88826ac4bb879622e43ead5bdb95aeb

SHA1
87d29853649a86f0463bfd9ad887b85eedc21723

SHA256
c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f

SHA512
f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\libssp-0.dll
Filesize
88KB

MD5
2c916456f503075f746c6ea649cf9539

SHA1
fa1afc1f3d728c89b2e90e14ca7d88b599580a9d

SHA256
cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6

SHA512
1c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\libwinpthread-1.dll
Filesize
188KB

MD5
d407cc6d79a08039a6f4b50539e560b8

SHA1
21171adbc176dc19aaa5e595cd2cd4bd1dfd0c71

SHA256
92cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e

SHA512
378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\torrc
Filesize
157B

MD5
439cd73927f46fde28540391feee8477

SHA1
ee7fb2aeb7708378abda293b03f5c9ffb6dbc742

SHA256
d1604e8bdb1a544638a97aa210b3e1eb12f1f159323d6b5942e03e11eafe9f75

SHA512
c11ad07964e190696f500468d52c61d8af5f075e7828ef00d525f06937f4205ca58eb3eabe5fd9cc8fa88c1d191de919429b6bbf3cdbb2dda6eed7d1b9ca7319

Download Submit
C:\Users\Admin\AppData\Local\d46500b0\tor\zlib1.dll
Filesize
52KB

MD5
add33041af894b67fe34e1dc819b7eb6

SHA1
6db46eb021855a587c95479422adcc774a272eeb

SHA256
8688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183

SHA512
bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa

Download Submit
\Users\Admin\AppData\Local\d46500b0\tor\libgcc_s_sjlj-1.dll
Filesize
286KB

MD5
b0d98f7157d972190fe0759d4368d320

SHA1
5715a533621a2b642aad9616e603c6907d80efc4

SHA256
2922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5

SHA512
41ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496

Download Submit
\Users\Admin\AppData\Local\d46500b0\tor\test2.exe
Filesize
973KB

MD5
5cfe61ff895c7daa889708665ef05d7b

SHA1
5e58efe30406243fbd58d4968b0492ddeef145f2

SHA256
f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5

SHA512
43b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da

Download Submit
memory/2052-248-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

Filesize
40KB

Download
memory/2052-45-0x0000000004000000-0x0000000004404000-memory.dmp

Filesize
4.0MB

Download
memory/2052-46-0x0000000000400000-0x0000000000BD8000-memory.dmp

Filesize
7.8MB

Download
memory/2052-333-0x0000000003400000-0x000000000340A000-memory.dmp

Filesize
40KB

Download
memory/2052-142-0x0000000000400000-0x0000000000BD8000-memory.dmp

Filesize
7.8MB

Download
memory/2052-178-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

Filesize
40KB

Download
memory/2052-160-0x0000000004C60000-0x0000000005064000-memory.dmp

Filesize
4.0MB

Download
memory/2052-120-0x0000000004C60000-0x0000000005064000-memory.dmp

Filesize
4.0MB

Download
memory/2052-247-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

Filesize
40KB

Download
memory/2052-219-0x00000000058C0000-0x0000000005CC4000-memory.dmp

Filesize
4.0MB

Download
memory/2052-258-0x00000000058C0000-0x0000000005CC4000-memory.dmp

Filesize
4.0MB

Download
memory/2052-57-0x0000000000400000-0x0000000000BD8000-memory.dmp

Filesize
7.8MB

Download
memory/2052-270-0x0000000003400000-0x000000000340A000-memory.dmp

Filesize
40KB

Download
memory/2052-71-0x0000000000400000-0x0000000000BD8000-memory.dmp

Filesize
7.8MB

Download
memory/2052-179-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

Filesize
40KB

Download
memory/2052-295-0x0000000005AC0000-0x0000000005EC4000-memory.dmp

Filesize
4.0MB

Download
memory/2052-20-0x0000000004000000-0x0000000004404000-memory.dmp

Filesize
4.0MB

Download
memory/2052-17-0x0000000004000000-0x0000000004404000-memory.dmp

Filesize
4.0MB

Download
memory/2052-0-0x0000000000400000-0x0000000000BD8000-memory.dmp

Filesize
7.8MB

Download
memory/2148-33-0x0000000073EB0000-0x0000000073FBA000-memory.dmp

Filesize
1.0MB

Download
memory/2148-98-0x00000000000D0000-0x00000000004D4000-memory.dmp

Filesize
4.0MB

Download
memory/2148-89-0x00000000000D0000-0x00000000004D4000-memory.dmp

Filesize
4.0MB

Download
memory/2148-79-0x00000000000D0000-0x00000000004D4000-memory.dmp

Filesize
4.0MB

Download
memory/2148-58-0x00000000000D0000-0x00000000004D4000-memory.dmp

Filesize
4.0MB

Download
memory/2148-51-0x0000000074580000-0x00000000745C9000-memory.dmp

Filesize
292KB

Download
memory/2148-52-0x00000000744B0000-0x0000000074578000-memory.dmp

Filesize
800KB

Download
memory/2148-53-0x0000000073EB0000-0x0000000073FBA000-memory.dmp

Filesize
1.0MB

Download
memory/2148-54-0x0000000073E20000-0x0000000073EA8000-memory.dmp

Filesize
544KB

Download
memory/2148-55-0x0000000073D50000-0x0000000073E1E000-memory.dmp

Filesize
824KB

Download
memory/2148-49-0x00000000000D0000-0x00000000004D4000-memory.dmp

Filesize
4.0MB

Download
memory/2148-48-0x0000000073FC0000-0x000000007428F000-memory.dmp

Filesize
2.8MB

Download
memory/2148-47-0x00000000000D0000-0x00000000004D4000-memory.dmp

Filesize
4.0MB

Download
memory/2148-25-0x0000000073FC0000-0x000000007428F000-memory.dmp

Filesize
2.8MB

Download
memory/2148-26-0x0000000074580000-0x00000000745C9000-memory.dmp

Filesize
292KB

Download
memory/2148-32-0x00000000744B0000-0x0000000074578000-memory.dmp

Filesize
800KB

Download
memory/2148-36-0x0000000073E20000-0x0000000073EA8000-memory.dmp

Filesize
544KB

Download
memory/2148-41-0x0000000074A20000-0x0000000074A44000-memory.dmp

Filesize
144KB

Download
memory/2148-40-0x0000000073D50000-0x0000000073E1E000-memory.dmp

Filesize
824KB

Download
memory/2148-21-0x00000000000D0000-0x00000000004D4000-memory.dmp

Filesize
4.0MB

Download
memory/2336-122-0x0000000074530000-0x0000000074579000-memory.dmp

Filesize
292KB

Download
memory/2336-123-0x00000000741C0000-0x0000000074288000-memory.dmp

Filesize
800KB

Download
memory/2336-161-0x00000000000D0000-0x00000000004D4000-memory.dmp

Filesize
4.0MB

Download
memory/2336-127-0x00000000745A0000-0x00000000745C4000-memory.dmp

Filesize
144KB

Download
memory/2336-128-0x00000000000D0000-0x00000000004D4000-memory.dmp

Filesize
4.0MB

Download
memory/2336-125-0x00000000744A0000-0x0000000074528000-memory.dmp

Filesize
544KB

Download
memory/2336-124-0x00000000740B0000-0x00000000741BA000-memory.dmp

Filesize
1.0MB

Download
memory/2336-150-0x00000000741C0000-0x0000000074288000-memory.dmp

Filesize
800KB

Download
memory/2336-126-0x0000000073FE0000-0x00000000740AE000-memory.dmp

Filesize
824KB

Download
memory/2336-205-0x00000000000D0000-0x00000000004D4000-memory.dmp

Filesize
4.0MB

Download
memory/2336-147-0x00000000000D0000-0x00000000004D4000-memory.dmp

Filesize
4.0MB

Download
memory/2336-121-0x0000000073CF0000-0x0000000073FBF000-memory.dmp

Filesize
2.8MB

Download
memory/2336-148-0x0000000073CF0000-0x0000000073FBF000-memory.dmp

Filesize
2.8MB

Download
memory/2336-153-0x0000000073FE0000-0x00000000740AE000-memory.dmp

Filesize
824KB

Download
memory/2840-305-0x0000000074240000-0x0000000074289000-memory.dmp

Filesize
292KB

Download
memory/2840-309-0x0000000073390000-0x000000007349A000-memory.dmp

Filesize
1.0MB

Download
memory/2840-307-0x0000000074020000-0x00000000740E8000-memory.dmp

Filesize
800KB

Download
memory/2840-310-0x0000000074130000-0x00000000741B8000-memory.dmp

Filesize
544KB

Download
memory/2840-311-0x00000000732C0000-0x000000007338E000-memory.dmp

Filesize
824KB

Download
memory/2840-313-0x0000000072E70000-0x000000007313F000-memory.dmp

Filesize
2.8MB

Download
memory/2840-312-0x0000000074500000-0x0000000074524000-memory.dmp

Filesize
144KB

Download
memory/2840-304-0x00000000000D0000-0x00000000004D4000-memory.dmp

Filesize
4.0MB

Download
memory/2948-223-0x00000000731D0000-0x000000007349F000-memory.dmp

Filesize
2.8MB

Download
memory/2948-289-0x00000000000D0000-0x00000000004D4000-memory.dmp

Filesize
4.0MB

Download
memory/2948-260-0x00000000731D0000-0x000000007349F000-memory.dmp

Filesize
2.8MB

Download
memory/2948-259-0x00000000000D0000-0x00000000004D4000-memory.dmp

Filesize
4.0MB

Download
memory/2948-220-0x00000000000D0000-0x00000000004D4000-memory.dmp

Filesize
4.0MB

Download
memory/2948-224-0x00000000744E0000-0x0000000074529000-memory.dmp

Filesize
292KB

Download
memory/2948-225-0x00000000740F0000-0x00000000741B8000-memory.dmp

Filesize
800KB

Download
memory/2948-226-0x0000000073FE0000-0x00000000740EA000-memory.dmp

Filesize
1.0MB

Download
memory/2948-227-0x0000000074200000-0x0000000074288000-memory.dmp

Filesize
544KB

Download
memory/2948-228-0x0000000073EF0000-0x0000000073FBE000-memory.dmp

Filesize
824KB

Download
memory/2948-229-0x0000000074550000-0x0000000074574000-memory.dmp

Filesize
144KB

Download