bitrat | 54d90bf7f12a3b1369e8ef4f708a58fed9d7950e1a87c9d5d805b974a148ce9e

Analysis

max time kernel
150s
max time network
188s
platform
windows7_x64
resource
win7v20210410
submitted
24/08/2021, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
369ed95e8e86dadbccfacde57d55cf8b.exe
Size 1.8MB
Sample210824-88gsaebets
SHA256 54d90bf7f12a3b1369e8ef4f708a58fed9d7950e1a87c9d5d805b974a148ce9e
MD5 369ed95e8e86dadbccfacde57d55cf8b
SHA1 5f1d4d191fd4f56d0e9c37d635ebf09938a2369c
SHA512 dced2361c8842381dd99257b2c74fbdfaf88361d798dbc9e9a75b87bab7c3b697e82f90aa70149c56c023477e6dd5ade016575168cee7d2a57c621bb5c3bf18b
MD5 SHA1 SHA512

Score

10^/10

bitrat suricata trojan upx

Malware Config

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1564-202-0x00000000007E2730-mapping.dmp	family_bitrat
behavioral1/memory/1564-213-0x0000000000400000-0x00000000007E4000-memory.dmp	family_bitrat

suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata

Executes dropped EXE 1 IoCs

pid	Process
1564	RegAsm.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1564-213-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1088	369ed95e8e86dadbccfacde57d55cf8b.exe
1564	RegAsm.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
1564	RegAsm.exe
1564	RegAsm.exe
1564	RegAsm.exe
1564	RegAsm.exe
1564	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1088 set thread context of 1564	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	51

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1848	powershell.exe
1848	powershell.exe
1036	powershell.exe
1036	powershell.exe
2000	powershell.exe
2000	powershell.exe
1284	powershell.exe
1284	powershell.exe
1492	powershell.exe
1492	powershell.exe
1928	powershell.exe
1928	powershell.exe
1620	powershell.exe
1620	powershell.exe
692	powershell.exe
692	powershell.exe
1760	powershell.exe
1760	powershell.exe
1556	powershell.exe
1556	powershell.exe
1088	369ed95e8e86dadbccfacde57d55cf8b.exe
1088	369ed95e8e86dadbccfacde57d55cf8b.exe
884	powershell.exe
884	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeIncreaseQuotaPrivilege	1848	powershell.exe
Token: SeSecurityPrivilege	1848	powershell.exe
Token: SeTakeOwnershipPrivilege	1848	powershell.exe
Token: SeLoadDriverPrivilege	1848	powershell.exe
Token: SeSystemProfilePrivilege	1848	powershell.exe
Token: SeSystemtimePrivilege	1848	powershell.exe
Token: SeProfSingleProcessPrivilege	1848	powershell.exe
Token: SeIncBasePriorityPrivilege	1848	powershell.exe
Token: SeCreatePagefilePrivilege	1848	powershell.exe
Token: SeBackupPrivilege	1848	powershell.exe
Token: SeRestorePrivilege	1848	powershell.exe
Token: SeShutdownPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeSystemEnvironmentPrivilege	1848	powershell.exe
Token: SeRemoteShutdownPrivilege	1848	powershell.exe
Token: SeUndockPrivilege	1848	powershell.exe
Token: SeManageVolumePrivilege	1848	powershell.exe
Token: 33	1848	powershell.exe
Token: 34	1848	powershell.exe
Token: 35	1848	powershell.exe
Token: SeIncreaseQuotaPrivilege	1848	powershell.exe
Token: SeSecurityPrivilege	1848	powershell.exe
Token: SeTakeOwnershipPrivilege	1848	powershell.exe
Token: SeLoadDriverPrivilege	1848	powershell.exe
Token: SeSystemProfilePrivilege	1848	powershell.exe
Token: SeSystemtimePrivilege	1848	powershell.exe
Token: SeProfSingleProcessPrivilege	1848	powershell.exe
Token: SeIncBasePriorityPrivilege	1848	powershell.exe
Token: SeCreatePagefilePrivilege	1848	powershell.exe
Token: SeBackupPrivilege	1848	powershell.exe
Token: SeRestorePrivilege	1848	powershell.exe
Token: SeShutdownPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeSystemEnvironmentPrivilege	1848	powershell.exe
Token: SeRemoteShutdownPrivilege	1848	powershell.exe
Token: SeUndockPrivilege	1848	powershell.exe
Token: SeManageVolumePrivilege	1848	powershell.exe
Token: 33	1848	powershell.exe
Token: 34	1848	powershell.exe
Token: 35	1848	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeIncreaseQuotaPrivilege	1036	powershell.exe
Token: SeSecurityPrivilege	1036	powershell.exe
Token: SeTakeOwnershipPrivilege	1036	powershell.exe
Token: SeLoadDriverPrivilege	1036	powershell.exe
Token: SeSystemProfilePrivilege	1036	powershell.exe
Token: SeSystemtimePrivilege	1036	powershell.exe
Token: SeProfSingleProcessPrivilege	1036	powershell.exe
Token: SeIncBasePriorityPrivilege	1036	powershell.exe
Token: SeCreatePagefilePrivilege	1036	powershell.exe
Token: SeBackupPrivilege	1036	powershell.exe
Token: SeRestorePrivilege	1036	powershell.exe
Token: SeShutdownPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeSystemEnvironmentPrivilege	1036	powershell.exe
Token: SeRemoteShutdownPrivilege	1036	powershell.exe
Token: SeUndockPrivilege	1036	powershell.exe
Token: SeManageVolumePrivilege	1036	powershell.exe
Token: 33	1036	powershell.exe
Token: 34	1036	powershell.exe
Token: 35	1036	powershell.exe
Token: SeIncreaseQuotaPrivilege	1036	powershell.exe
Token: SeSecurityPrivilege	1036	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1564	RegAsm.exe
1564	RegAsm.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1848	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	26
PID 1088 wrote to memory of 1848	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	26
PID 1088 wrote to memory of 1848	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	26
PID 1088 wrote to memory of 1848	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	26
PID 1088 wrote to memory of 1036	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	32
PID 1088 wrote to memory of 1036	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	32
PID 1088 wrote to memory of 1036	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	32
PID 1088 wrote to memory of 1036	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	32
PID 1088 wrote to memory of 2000	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	34
PID 1088 wrote to memory of 2000	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	34
PID 1088 wrote to memory of 2000	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	34
PID 1088 wrote to memory of 2000	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	34
PID 1088 wrote to memory of 1284	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	36
PID 1088 wrote to memory of 1284	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	36
PID 1088 wrote to memory of 1284	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	36
PID 1088 wrote to memory of 1284	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	36
PID 1088 wrote to memory of 1492	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	38
PID 1088 wrote to memory of 1492	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	38
PID 1088 wrote to memory of 1492	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	38
PID 1088 wrote to memory of 1492	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	38
PID 1088 wrote to memory of 1928	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	40
PID 1088 wrote to memory of 1928	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	40
PID 1088 wrote to memory of 1928	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	40
PID 1088 wrote to memory of 1928	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	40
PID 1088 wrote to memory of 1620	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	42
PID 1088 wrote to memory of 1620	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	42
PID 1088 wrote to memory of 1620	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	42
PID 1088 wrote to memory of 1620	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	42
PID 1088 wrote to memory of 692	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	44
PID 1088 wrote to memory of 692	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	44
PID 1088 wrote to memory of 692	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	44
PID 1088 wrote to memory of 692	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	44
PID 1088 wrote to memory of 1760	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	46
PID 1088 wrote to memory of 1760	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	46
PID 1088 wrote to memory of 1760	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	46
PID 1088 wrote to memory of 1760	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	46
PID 1088 wrote to memory of 1556	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	48
PID 1088 wrote to memory of 1556	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	48
PID 1088 wrote to memory of 1556	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	48
PID 1088 wrote to memory of 1556	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	48
PID 1088 wrote to memory of 1736	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	50
PID 1088 wrote to memory of 1736	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	50
PID 1088 wrote to memory of 1736	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	50
PID 1088 wrote to memory of 1736	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	50
PID 1088 wrote to memory of 1564	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	51
PID 1088 wrote to memory of 1564	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	51
PID 1088 wrote to memory of 1564	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	51
PID 1088 wrote to memory of 1564	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	51
PID 1088 wrote to memory of 1564	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	51
PID 1088 wrote to memory of 1564	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	51
PID 1088 wrote to memory of 1564	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	51
PID 1088 wrote to memory of 1564	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	51
PID 1088 wrote to memory of 1564	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	51
PID 1088 wrote to memory of 1564	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	51
PID 1088 wrote to memory of 1564	1088	369ed95e8e86dadbccfacde57d55cf8b.exe	51

C:\Users\Admin\AppData\Local\Temp\369ed95e8e86dadbccfacde57d55cf8b.exe
"C:\Users\Admin\AppData\Local\Temp\369ed95e8e86dadbccfacde57d55cf8b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1848
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1620
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Ijivvyhbys.vbs"
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\outlook.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:884
- C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
  C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:1564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/692-172-0x0000000004932000-0x0000000004933000-memory.dmp

Download

memory/692-171-0x0000000004930000-0x0000000004931000-memory.dmp

Download

memory/884-214-0x0000000004880000-0x0000000004881000-memory.dmp

Download

memory/884-215-0x0000000004882000-0x0000000004883000-memory.dmp

Download

memory/884-233-0x000000007EF30000-0x000000007EF31000-memory.dmp

Download

memory/1036-94-0x0000000002600000-0x0000000002601000-memory.dmp

Download

memory/1036-92-0x0000000002400000-0x0000000002401000-memory.dmp

Download

memory/1036-97-0x00000000049D2000-0x00000000049D3000-memory.dmp

Download

memory/1036-96-0x00000000049D0000-0x00000000049D1000-memory.dmp

Download

memory/1036-108-0x00000000064E0000-0x00000000064E1000-memory.dmp

Download

memory/1036-95-0x0000000005300000-0x0000000005301000-memory.dmp

Download

memory/1036-105-0x00000000056A0000-0x00000000056A1000-memory.dmp

Download

memory/1036-93-0x0000000004A10000-0x0000000004A11000-memory.dmp

Download

memory/1088-62-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Download

memory/1088-60-0x0000000000E00000-0x0000000000E01000-memory.dmp

Download

memory/1284-128-0x0000000002162000-0x0000000002163000-memory.dmp

Download

memory/1284-127-0x0000000002160000-0x0000000002161000-memory.dmp

Download

memory/1492-137-0x00000000048B0000-0x00000000048B1000-memory.dmp

Download

memory/1492-139-0x00000000048B2000-0x00000000048B3000-memory.dmp

Download

memory/1556-192-0x0000000004930000-0x0000000004931000-memory.dmp

Download

memory/1556-193-0x0000000004932000-0x0000000004933000-memory.dmp

Download

memory/1564-213-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/1620-160-0x0000000001010000-0x0000000001011000-memory.dmp

Download

memory/1620-161-0x0000000001012000-0x0000000001013000-memory.dmp

Download

memory/1760-183-0x0000000000EE2000-0x0000000000EE3000-memory.dmp

Download

memory/1760-182-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Download

memory/1848-87-0x000000007EF30000-0x000000007EF31000-memory.dmp

Download

memory/1848-86-0x00000000061C0000-0x00000000061C1000-memory.dmp

Download

memory/1848-79-0x0000000006230000-0x0000000006231000-memory.dmp

Download

memory/1848-78-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/1848-67-0x0000000004990000-0x0000000004991000-memory.dmp

Download

memory/1848-73-0x00000000055F0000-0x00000000055F1000-memory.dmp

Download

memory/1848-68-0x0000000004992000-0x0000000004993000-memory.dmp

Download

memory/1848-88-0x00000000065D0000-0x00000000065D1000-memory.dmp

Download

memory/1848-69-0x0000000002540000-0x0000000002541000-memory.dmp

Download

memory/1848-70-0x0000000004750000-0x0000000004751000-memory.dmp

Download

memory/1848-64-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Download

memory/1848-65-0x0000000000D50000-0x0000000000D51000-memory.dmp

Download

memory/1848-66-0x00000000049D0000-0x00000000049D1000-memory.dmp

Download

memory/1928-150-0x00000000024D0000-0x000000000311A000-memory.dmp

Download

memory/2000-115-0x0000000005300000-0x0000000005301000-memory.dmp

Download

memory/2000-117-0x00000000048F2000-0x00000000048F3000-memory.dmp

Download

memory/2000-119-0x0000000006650000-0x0000000006651000-memory.dmp

Download

memory/2000-112-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/2000-116-0x00000000048F0000-0x00000000048F1000-memory.dmp

Download

memory/2000-113-0x0000000004930000-0x0000000004931000-memory.dmp

Download

memory/2000-118-0x00000000056A0000-0x00000000056A1000-memory.dmp

Download