bitrat | 704e26dbdebc8b3ad1391f5b9d671f8b9550609455821540151ff70e17bed798

Analysis

max time kernel
151s
max time network
150s
platform
windows10_x64
resource
win10v20210410
submitted
15/08/2021, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aba32a475dcafdf4c6357205803e4cc0.exe
Size 2.0MB
Sample210815-tdbcbr78aa
SHA256 704e26dbdebc8b3ad1391f5b9d671f8b9550609455821540151ff70e17bed798
MD5 aba32a475dcafdf4c6357205803e4cc0
SHA1 0d063e81d9b4df0fcf358c24720457f9037cde06
SHA512 04e55bff24005489988e54926afa9addc1b457881525ae1a1cf9a73f05928e7347f906959e1689019c73112c181f6f718118f7630ada8eadfa424bac918cad67
MD5 SHA1 SHA512

Score

10^/10

bitrat suricata trojan upx

Malware Config

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2980-224-0x00000000007E2730-mapping.dmp	family_bitrat
behavioral2/memory/2980-241-0x0000000000400000-0x00000000007E4000-memory.dmp	family_bitrat

suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2980-223-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2980-241-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2980	aba32a475dcafdf4c6357205803e4cc0.exe
2980	aba32a475dcafdf4c6357205803e4cc0.exe
2980	aba32a475dcafdf4c6357205803e4cc0.exe
2980	aba32a475dcafdf4c6357205803e4cc0.exe
2980	aba32a475dcafdf4c6357205803e4cc0.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3984 set thread context of 2980	3984	aba32a475dcafdf4c6357205803e4cc0.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	aba32a475dcafdf4c6357205803e4cc0.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1956	powershell.exe
1956	powershell.exe
1956	powershell.exe
3984	aba32a475dcafdf4c6357205803e4cc0.exe
3984	aba32a475dcafdf4c6357205803e4cc0.exe
3984	aba32a475dcafdf4c6357205803e4cc0.exe
3984	aba32a475dcafdf4c6357205803e4cc0.exe
3984	aba32a475dcafdf4c6357205803e4cc0.exe
3984	aba32a475dcafdf4c6357205803e4cc0.exe
1228	powershell.exe
1228	powershell.exe
1228	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeIncreaseQuotaPrivilege	1956	powershell.exe
Token: SeSecurityPrivilege	1956	powershell.exe
Token: SeTakeOwnershipPrivilege	1956	powershell.exe
Token: SeLoadDriverPrivilege	1956	powershell.exe
Token: SeSystemProfilePrivilege	1956	powershell.exe
Token: SeSystemtimePrivilege	1956	powershell.exe
Token: SeProfSingleProcessPrivilege	1956	powershell.exe
Token: SeIncBasePriorityPrivilege	1956	powershell.exe
Token: SeCreatePagefilePrivilege	1956	powershell.exe
Token: SeBackupPrivilege	1956	powershell.exe
Token: SeRestorePrivilege	1956	powershell.exe
Token: SeShutdownPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeSystemEnvironmentPrivilege	1956	powershell.exe
Token: SeRemoteShutdownPrivilege	1956	powershell.exe
Token: SeUndockPrivilege	1956	powershell.exe
Token: SeManageVolumePrivilege	1956	powershell.exe
Token: 33	1956	powershell.exe
Token: 34	1956	powershell.exe
Token: 35	1956	powershell.exe
Token: 36	1956	powershell.exe
Token: SeIncreaseQuotaPrivilege	1956	powershell.exe
Token: SeSecurityPrivilege	1956	powershell.exe
Token: SeTakeOwnershipPrivilege	1956	powershell.exe
Token: SeLoadDriverPrivilege	1956	powershell.exe
Token: SeSystemProfilePrivilege	1956	powershell.exe
Token: SeSystemtimePrivilege	1956	powershell.exe
Token: SeProfSingleProcessPrivilege	1956	powershell.exe
Token: SeIncBasePriorityPrivilege	1956	powershell.exe
Token: SeCreatePagefilePrivilege	1956	powershell.exe
Token: SeBackupPrivilege	1956	powershell.exe
Token: SeRestorePrivilege	1956	powershell.exe
Token: SeShutdownPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeSystemEnvironmentPrivilege	1956	powershell.exe
Token: SeRemoteShutdownPrivilege	1956	powershell.exe
Token: SeUndockPrivilege	1956	powershell.exe
Token: SeManageVolumePrivilege	1956	powershell.exe
Token: 33	1956	powershell.exe
Token: 34	1956	powershell.exe
Token: 35	1956	powershell.exe
Token: 36	1956	powershell.exe
Token: SeDebugPrivilege	3984	aba32a475dcafdf4c6357205803e4cc0.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeShutdownPrivilege	2980	aba32a475dcafdf4c6357205803e4cc0.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2980	aba32a475dcafdf4c6357205803e4cc0.exe
2980	aba32a475dcafdf4c6357205803e4cc0.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 1956	3984	aba32a475dcafdf4c6357205803e4cc0.exe	77
PID 3984 wrote to memory of 1956	3984	aba32a475dcafdf4c6357205803e4cc0.exe	77
PID 3984 wrote to memory of 1956	3984	aba32a475dcafdf4c6357205803e4cc0.exe	77
PID 3984 wrote to memory of 3544	3984	aba32a475dcafdf4c6357205803e4cc0.exe	80
PID 3984 wrote to memory of 3544	3984	aba32a475dcafdf4c6357205803e4cc0.exe	80
PID 3984 wrote to memory of 3544	3984	aba32a475dcafdf4c6357205803e4cc0.exe	80
PID 3984 wrote to memory of 3412	3984	aba32a475dcafdf4c6357205803e4cc0.exe	81
PID 3984 wrote to memory of 3412	3984	aba32a475dcafdf4c6357205803e4cc0.exe	81
PID 3984 wrote to memory of 3412	3984	aba32a475dcafdf4c6357205803e4cc0.exe	81
PID 3984 wrote to memory of 2980	3984	aba32a475dcafdf4c6357205803e4cc0.exe	82
PID 3984 wrote to memory of 2980	3984	aba32a475dcafdf4c6357205803e4cc0.exe	82
PID 3984 wrote to memory of 2980	3984	aba32a475dcafdf4c6357205803e4cc0.exe	82
PID 3984 wrote to memory of 2980	3984	aba32a475dcafdf4c6357205803e4cc0.exe	82
PID 3984 wrote to memory of 2980	3984	aba32a475dcafdf4c6357205803e4cc0.exe	82
PID 3984 wrote to memory of 2980	3984	aba32a475dcafdf4c6357205803e4cc0.exe	82
PID 3984 wrote to memory of 2980	3984	aba32a475dcafdf4c6357205803e4cc0.exe	82
PID 3544 wrote to memory of 1228	3544	WScript.exe	83
PID 3544 wrote to memory of 1228	3544	WScript.exe	83
PID 3544 wrote to memory of 1228	3544	WScript.exe	83

C:\Users\Admin\AppData\Local\Temp\aba32a475dcafdf4c6357205803e4cc0.exe
"C:\Users\Admin\AppData\Local\Temp\aba32a475dcafdf4c6357205803e4cc0.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Cjvdnberkfbwqwrpbjverv.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Adobe\Acrobat Reader DC.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1228
- C:\Users\Admin\AppData\Local\Temp\aba32a475dcafdf4c6357205803e4cc0.exe
  C:\Users\Admin\AppData\Local\Temp\aba32a475dcafdf4c6357205803e4cc0.exe
  2⤵
  PID:3412
- C:\Users\Admin\AppData\Local\Temp\aba32a475dcafdf4c6357205803e4cc0.exe
  C:\Users\Admin\AppData\Local\Temp\aba32a475dcafdf4c6357205803e4cc0.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-256-0x0000000009340000-0x0000000009341000-memory.dmp

Download

memory/1228-317-0x000000007F3A0000-0x000000007F3A1000-memory.dmp

Download

memory/1228-261-0x0000000009700000-0x0000000009701000-memory.dmp

Download

memory/1228-318-0x00000000030F3000-0x00000000030F4000-memory.dmp

Download

memory/1228-249-0x0000000009360000-0x0000000009393000-memory.dmp

Download

memory/1228-243-0x00000000030F2000-0x00000000030F3000-memory.dmp

Download

memory/1228-242-0x00000000030F0000-0x00000000030F1000-memory.dmp

Download

memory/1228-237-0x00000000087B0000-0x00000000087B1000-memory.dmp

Download

memory/1228-457-0x0000000009820000-0x0000000009821000-memory.dmp

Download

memory/1228-234-0x0000000007E50000-0x0000000007E51000-memory.dmp

Download

memory/1228-463-0x0000000009810000-0x0000000009811000-memory.dmp

Download

memory/1956-127-0x0000000007790000-0x0000000007791000-memory.dmp

Download

memory/1956-126-0x0000000007080000-0x0000000007081000-memory.dmp

Download

memory/1956-134-0x0000000008120000-0x0000000008121000-memory.dmp

Download

memory/1956-139-0x0000000008ED0000-0x0000000008ED1000-memory.dmp

Download

memory/1956-140-0x0000000008DF0000-0x0000000008DF1000-memory.dmp

Download

memory/1956-141-0x0000000008E60000-0x0000000008E61000-memory.dmp

Download

memory/1956-149-0x000000000A200000-0x000000000A201000-memory.dmp

Download

memory/1956-166-0x0000000006AB3000-0x0000000006AB4000-memory.dmp

Download

memory/1956-124-0x0000000006980000-0x0000000006981000-memory.dmp

Download

memory/1956-132-0x0000000007880000-0x0000000007881000-memory.dmp

Download

memory/1956-125-0x00000000070F0000-0x00000000070F1000-memory.dmp

Download

memory/1956-130-0x0000000006AB0000-0x0000000006AB1000-memory.dmp

Download

memory/1956-133-0x0000000008330000-0x0000000008331000-memory.dmp

Download

memory/1956-131-0x0000000006AB2000-0x0000000006AB3000-memory.dmp

Download

memory/1956-129-0x0000000007A50000-0x0000000007A51000-memory.dmp

Download

memory/1956-128-0x00000000079E0000-0x00000000079E1000-memory.dmp

Download

memory/2980-241-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/2980-223-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3984-114-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/3984-220-0x00000000086D0000-0x0000000008736000-memory.dmp

Download

memory/3984-120-0x00000000051E0000-0x00000000056DE000-memory.dmp

Download

memory/3984-119-0x00000000075B0000-0x0000000007754000-memory.dmp

Download

memory/3984-118-0x00000000051B0000-0x00000000051B1000-memory.dmp

Download

memory/3984-117-0x0000000005100000-0x0000000005101000-memory.dmp

Download

memory/3984-116-0x00000000056E0000-0x00000000056E1000-memory.dmp

Download