bitrat | 54d90bf7f12a3b1369e8ef4f708a58fed9d7950e1a87c9d5d805b974a148ce9e

Analysis

max time kernel
150s
max time network
153s
platform
windows10_x64
resource
win10v20210408
submitted
24/08/2021, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
369ed95e8e86dadbccfacde57d55cf8b.exe
Size 1.8MB
Sample210824-88gsaebets
SHA256 54d90bf7f12a3b1369e8ef4f708a58fed9d7950e1a87c9d5d805b974a148ce9e
MD5 369ed95e8e86dadbccfacde57d55cf8b
SHA1 5f1d4d191fd4f56d0e9c37d635ebf09938a2369c
SHA512 dced2361c8842381dd99257b2c74fbdfaf88361d798dbc9e9a75b87bab7c3b697e82f90aa70149c56c023477e6dd5ade016575168cee7d2a57c621bb5c3bf18b
MD5 SHA1 SHA512

Score

10^/10

bitrat trojan upx

Malware Config

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1572-1102-0x0000000000400000-0x00000000007E4000-memory.dmp	family_bitrat

Executes dropped EXE 1 IoCs

pid	Process
1572	RegAsm.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1572-1102-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
1572	RegAsm.exe
1572	RegAsm.exe
1572	RegAsm.exe
1572	RegAsm.exe
1572	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 636 set thread context of 1572	636	369ed95e8e86dadbccfacde57d55cf8b.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	369ed95e8e86dadbccfacde57d55cf8b.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3276	powershell.exe
3276	powershell.exe
3276	powershell.exe
2196	powershell.exe
2196	powershell.exe
2196	powershell.exe
1152	powershell.exe
1152	powershell.exe
1152	powershell.exe
1252	powershell.exe
1252	powershell.exe
1252	powershell.exe
688	powershell.exe
688	powershell.exe
688	powershell.exe
192	powershell.exe
192	powershell.exe
192	powershell.exe
1868	powershell.exe
1868	powershell.exe
1868	powershell.exe
1016	powershell.exe
1016	powershell.exe
1016	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
2672	powershell.exe
2672	powershell.exe
2672	powershell.exe
636	369ed95e8e86dadbccfacde57d55cf8b.exe
636	369ed95e8e86dadbccfacde57d55cf8b.exe
1004	powershell.exe
1004	powershell.exe
1004	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeIncreaseQuotaPrivilege	3276	powershell.exe
Token: SeSecurityPrivilege	3276	powershell.exe
Token: SeTakeOwnershipPrivilege	3276	powershell.exe
Token: SeLoadDriverPrivilege	3276	powershell.exe
Token: SeSystemProfilePrivilege	3276	powershell.exe
Token: SeSystemtimePrivilege	3276	powershell.exe
Token: SeProfSingleProcessPrivilege	3276	powershell.exe
Token: SeIncBasePriorityPrivilege	3276	powershell.exe
Token: SeCreatePagefilePrivilege	3276	powershell.exe
Token: SeBackupPrivilege	3276	powershell.exe
Token: SeRestorePrivilege	3276	powershell.exe
Token: SeShutdownPrivilege	3276	powershell.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeSystemEnvironmentPrivilege	3276	powershell.exe
Token: SeRemoteShutdownPrivilege	3276	powershell.exe
Token: SeUndockPrivilege	3276	powershell.exe
Token: SeManageVolumePrivilege	3276	powershell.exe
Token: 33	3276	powershell.exe
Token: 34	3276	powershell.exe
Token: 35	3276	powershell.exe
Token: 36	3276	powershell.exe
Token: SeIncreaseQuotaPrivilege	3276	powershell.exe
Token: SeSecurityPrivilege	3276	powershell.exe
Token: SeTakeOwnershipPrivilege	3276	powershell.exe
Token: SeLoadDriverPrivilege	3276	powershell.exe
Token: SeSystemProfilePrivilege	3276	powershell.exe
Token: SeSystemtimePrivilege	3276	powershell.exe
Token: SeProfSingleProcessPrivilege	3276	powershell.exe
Token: SeIncBasePriorityPrivilege	3276	powershell.exe
Token: SeCreatePagefilePrivilege	3276	powershell.exe
Token: SeBackupPrivilege	3276	powershell.exe
Token: SeRestorePrivilege	3276	powershell.exe
Token: SeShutdownPrivilege	3276	powershell.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeSystemEnvironmentPrivilege	3276	powershell.exe
Token: SeRemoteShutdownPrivilege	3276	powershell.exe
Token: SeUndockPrivilege	3276	powershell.exe
Token: SeManageVolumePrivilege	3276	powershell.exe
Token: 33	3276	powershell.exe
Token: 34	3276	powershell.exe
Token: 35	3276	powershell.exe
Token: 36	3276	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeIncreaseQuotaPrivilege	2196	powershell.exe
Token: SeSecurityPrivilege	2196	powershell.exe
Token: SeTakeOwnershipPrivilege	2196	powershell.exe
Token: SeLoadDriverPrivilege	2196	powershell.exe
Token: SeSystemProfilePrivilege	2196	powershell.exe
Token: SeSystemtimePrivilege	2196	powershell.exe
Token: SeProfSingleProcessPrivilege	2196	powershell.exe
Token: SeIncBasePriorityPrivilege	2196	powershell.exe
Token: SeCreatePagefilePrivilege	2196	powershell.exe
Token: SeBackupPrivilege	2196	powershell.exe
Token: SeRestorePrivilege	2196	powershell.exe
Token: SeShutdownPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeSystemEnvironmentPrivilege	2196	powershell.exe
Token: SeRemoteShutdownPrivilege	2196	powershell.exe
Token: SeUndockPrivilege	2196	powershell.exe
Token: SeManageVolumePrivilege	2196	powershell.exe
Token: 33	2196	powershell.exe
Token: 34	2196	powershell.exe
Token: 35	2196	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1572	RegAsm.exe
1572	RegAsm.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3276	636	369ed95e8e86dadbccfacde57d55cf8b.exe	75
PID 636 wrote to memory of 3276	636	369ed95e8e86dadbccfacde57d55cf8b.exe	75
PID 636 wrote to memory of 3276	636	369ed95e8e86dadbccfacde57d55cf8b.exe	75
PID 636 wrote to memory of 2196	636	369ed95e8e86dadbccfacde57d55cf8b.exe	79
PID 636 wrote to memory of 2196	636	369ed95e8e86dadbccfacde57d55cf8b.exe	79
PID 636 wrote to memory of 2196	636	369ed95e8e86dadbccfacde57d55cf8b.exe	79
PID 636 wrote to memory of 1152	636	369ed95e8e86dadbccfacde57d55cf8b.exe	81
PID 636 wrote to memory of 1152	636	369ed95e8e86dadbccfacde57d55cf8b.exe	81
PID 636 wrote to memory of 1152	636	369ed95e8e86dadbccfacde57d55cf8b.exe	81
PID 636 wrote to memory of 1252	636	369ed95e8e86dadbccfacde57d55cf8b.exe	84
PID 636 wrote to memory of 1252	636	369ed95e8e86dadbccfacde57d55cf8b.exe	84
PID 636 wrote to memory of 1252	636	369ed95e8e86dadbccfacde57d55cf8b.exe	84
PID 636 wrote to memory of 688	636	369ed95e8e86dadbccfacde57d55cf8b.exe	86
PID 636 wrote to memory of 688	636	369ed95e8e86dadbccfacde57d55cf8b.exe	86
PID 636 wrote to memory of 688	636	369ed95e8e86dadbccfacde57d55cf8b.exe	86
PID 636 wrote to memory of 192	636	369ed95e8e86dadbccfacde57d55cf8b.exe	88
PID 636 wrote to memory of 192	636	369ed95e8e86dadbccfacde57d55cf8b.exe	88
PID 636 wrote to memory of 192	636	369ed95e8e86dadbccfacde57d55cf8b.exe	88
PID 636 wrote to memory of 1868	636	369ed95e8e86dadbccfacde57d55cf8b.exe	90
PID 636 wrote to memory of 1868	636	369ed95e8e86dadbccfacde57d55cf8b.exe	90
PID 636 wrote to memory of 1868	636	369ed95e8e86dadbccfacde57d55cf8b.exe	90
PID 636 wrote to memory of 1016	636	369ed95e8e86dadbccfacde57d55cf8b.exe	92
PID 636 wrote to memory of 1016	636	369ed95e8e86dadbccfacde57d55cf8b.exe	92
PID 636 wrote to memory of 1016	636	369ed95e8e86dadbccfacde57d55cf8b.exe	92
PID 636 wrote to memory of 3676	636	369ed95e8e86dadbccfacde57d55cf8b.exe	94
PID 636 wrote to memory of 3676	636	369ed95e8e86dadbccfacde57d55cf8b.exe	94
PID 636 wrote to memory of 3676	636	369ed95e8e86dadbccfacde57d55cf8b.exe	94
PID 636 wrote to memory of 2672	636	369ed95e8e86dadbccfacde57d55cf8b.exe	96
PID 636 wrote to memory of 2672	636	369ed95e8e86dadbccfacde57d55cf8b.exe	96
PID 636 wrote to memory of 2672	636	369ed95e8e86dadbccfacde57d55cf8b.exe	96
PID 636 wrote to memory of 3084	636	369ed95e8e86dadbccfacde57d55cf8b.exe	98
PID 636 wrote to memory of 3084	636	369ed95e8e86dadbccfacde57d55cf8b.exe	98
PID 636 wrote to memory of 3084	636	369ed95e8e86dadbccfacde57d55cf8b.exe	98
PID 636 wrote to memory of 1572	636	369ed95e8e86dadbccfacde57d55cf8b.exe	99
PID 636 wrote to memory of 1572	636	369ed95e8e86dadbccfacde57d55cf8b.exe	99
PID 636 wrote to memory of 1572	636	369ed95e8e86dadbccfacde57d55cf8b.exe	99
PID 636 wrote to memory of 1572	636	369ed95e8e86dadbccfacde57d55cf8b.exe	99
PID 636 wrote to memory of 1572	636	369ed95e8e86dadbccfacde57d55cf8b.exe	99
PID 636 wrote to memory of 1572	636	369ed95e8e86dadbccfacde57d55cf8b.exe	99
PID 636 wrote to memory of 1572	636	369ed95e8e86dadbccfacde57d55cf8b.exe	99
PID 3084 wrote to memory of 1004	3084	WScript.exe	100
PID 3084 wrote to memory of 1004	3084	WScript.exe	100
PID 3084 wrote to memory of 1004	3084	WScript.exe	100

C:\Users\Admin\AppData\Local\Temp\369ed95e8e86dadbccfacde57d55cf8b.exe
"C:\Users\Admin\AppData\Local\Temp\369ed95e8e86dadbccfacde57d55cf8b.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3276
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1252
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:192
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1016
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2672
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Ijivvyhbys.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\outlook.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1004
- C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
  C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/192-612-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Download

memory/192-646-0x0000000000EF3000-0x0000000000EF4000-memory.dmp

Download

memory/192-613-0x0000000000EF2000-0x0000000000EF3000-memory.dmp

Download

memory/636-119-0x0000000005560000-0x0000000005561000-memory.dmp

Download

memory/636-118-0x0000000005300000-0x00000000057FE000-memory.dmp

Download

memory/636-114-0x0000000000A00000-0x0000000000A01000-memory.dmp

Download

memory/636-117-0x0000000005400000-0x0000000005401000-memory.dmp

Download

memory/636-116-0x0000000005800000-0x0000000005801000-memory.dmp

Download

memory/688-517-0x0000000000D42000-0x0000000000D43000-memory.dmp

Download

memory/688-534-0x0000000000D43000-0x0000000000D44000-memory.dmp

Download

memory/688-516-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/1004-1127-0x0000000006C53000-0x0000000006C54000-memory.dmp

Download

memory/1004-1113-0x000000007EBA0000-0x000000007EBA1000-memory.dmp

Download

memory/1004-1104-0x0000000006C50000-0x0000000006C51000-memory.dmp

Download

memory/1004-1105-0x0000000006C52000-0x0000000006C53000-memory.dmp

Download

memory/1016-823-0x0000000004963000-0x0000000004964000-memory.dmp

Download

memory/1016-799-0x0000000004962000-0x0000000004963000-memory.dmp

Download

memory/1016-798-0x0000000004960000-0x0000000004961000-memory.dmp

Download

memory/1152-358-0x0000000007073000-0x0000000007074000-memory.dmp

Download

memory/1152-324-0x0000000007072000-0x0000000007073000-memory.dmp

Download

memory/1152-322-0x0000000007070000-0x0000000007071000-memory.dmp

Download

memory/1252-415-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/1252-417-0x0000000000AB2000-0x0000000000AB3000-memory.dmp

Download

memory/1252-454-0x0000000000AB3000-0x0000000000AB4000-memory.dmp

Download

memory/1572-1102-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/1868-706-0x0000000006F90000-0x0000000006F91000-memory.dmp

Download

memory/1868-707-0x0000000006F92000-0x0000000006F93000-memory.dmp

Download

memory/1868-742-0x0000000006F93000-0x0000000006F94000-memory.dmp

Download

memory/2196-225-0x0000000000D90000-0x0000000000D91000-memory.dmp

Download

memory/2196-249-0x0000000000D93000-0x0000000000D94000-memory.dmp

Download

memory/2196-226-0x0000000000D92000-0x0000000000D93000-memory.dmp

Download

memory/2672-1015-0x0000000004993000-0x0000000004994000-memory.dmp

Download

memory/2672-994-0x0000000004992000-0x0000000004993000-memory.dmp

Download

memory/2672-993-0x0000000004990000-0x0000000004991000-memory.dmp

Download

memory/3276-148-0x0000000009CA0000-0x0000000009CA1000-memory.dmp

Download

memory/3276-131-0x0000000006EB0000-0x0000000006EB1000-memory.dmp

Download

memory/3276-123-0x0000000006890000-0x0000000006891000-memory.dmp

Download

memory/3276-124-0x0000000000E40000-0x0000000000E41000-memory.dmp

Download

memory/3276-149-0x0000000006893000-0x0000000006894000-memory.dmp

Download

memory/3276-140-0x0000000008B10000-0x0000000008B11000-memory.dmp

Download

memory/3276-139-0x0000000008A90000-0x0000000008A91000-memory.dmp

Download

memory/3276-138-0x0000000008B80000-0x0000000008B81000-memory.dmp

Download

memory/3276-133-0x0000000007E00000-0x0000000007E01000-memory.dmp

Download

memory/3276-132-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Download

memory/3276-125-0x0000000006ED0000-0x0000000006ED1000-memory.dmp

Download

memory/3276-130-0x0000000007670000-0x0000000007671000-memory.dmp

Download

memory/3276-129-0x0000000006E20000-0x0000000006E21000-memory.dmp

Download

memory/3276-128-0x0000000007600000-0x0000000007601000-memory.dmp

Download

memory/3276-127-0x0000000006DF0000-0x0000000006DF1000-memory.dmp

Download

memory/3276-126-0x0000000006892000-0x0000000006893000-memory.dmp

Download

memory/3676-900-0x00000000044B0000-0x00000000044B1000-memory.dmp

Download

memory/3676-934-0x00000000044B3000-0x00000000044B4000-memory.dmp

Download

memory/3676-901-0x00000000044B2000-0x00000000044B3000-memory.dmp

Download