bitrat | 3a3ff370dac609a17ea67e35e81a3b82702afe6660bb3439a489ff8f4350d607

General

Target
A65C5D8268DAF8603D3F4861991CB09E.exe
Size 1.6MB
Sample210824-dczl87cb1a
SHA256 3a3ff370dac609a17ea67e35e81a3b82702afe6660bb3439a489ff8f4350d607
MD5 a65c5d8268daf8603d3f4861991cb09e
SHA1 8b22cbad5c3d38e4a683f1b68a3b9037eb3559f1
SHA512 faad2d2928c982f30d10299ae266571127bd98d16a7577f9c2e5a10f349ea92855da2fa180bfb355daa88e9a6e2f38ad335bec61fd7f13c0a102ac4480baff4e
MD5 SHA1 SHA512

Score

10^/10

bitrat xenarmor password recovery spyware stealer suricata trojan upx

Malware Config

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2616-117-0x0000000000400000-0x00000000007E4000-memory.dmp	family_bitrat

XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
recovery password xenarmor
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000100000001ab9d-123.dat	acprotect
behavioral2/files/0x000100000001ab9d-124.dat	acprotect

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2616-114-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2616-117-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/412-118-0x0000000000400000-0x00000000008DC000-memory.dmp	upx
behavioral2/memory/412-122-0x0000000000400000-0x00000000008DC000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
3408	A65C5D8268DAF8603D3F4861991CB09E.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2616	A65C5D8268DAF8603D3F4861991CB09E.exe
2616	A65C5D8268DAF8603D3F4861991CB09E.exe
2616	A65C5D8268DAF8603D3F4861991CB09E.exe
2616	A65C5D8268DAF8603D3F4861991CB09E.exe
2616	A65C5D8268DAF8603D3F4861991CB09E.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2752 set thread context of 2616	2752	A65C5D8268DAF8603D3F4861991CB09E.exe	78
PID 2616 set thread context of 412	2616	A65C5D8268DAF8603D3F4861991CB09E.exe	80
PID 412 set thread context of 3408	412	A65C5D8268DAF8603D3F4861991CB09E.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3408	A65C5D8268DAF8603D3F4861991CB09E.exe
3408	A65C5D8268DAF8603D3F4861991CB09E.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2616	A65C5D8268DAF8603D3F4861991CB09E.exe
Token: SeDebugPrivilege	3408	A65C5D8268DAF8603D3F4861991CB09E.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2616	A65C5D8268DAF8603D3F4861991CB09E.exe
2616	A65C5D8268DAF8603D3F4861991CB09E.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2616	2752	A65C5D8268DAF8603D3F4861991CB09E.exe	78
PID 2752 wrote to memory of 2616	2752	A65C5D8268DAF8603D3F4861991CB09E.exe	78
PID 2752 wrote to memory of 2616	2752	A65C5D8268DAF8603D3F4861991CB09E.exe	78
PID 2752 wrote to memory of 2616	2752	A65C5D8268DAF8603D3F4861991CB09E.exe	78
PID 2752 wrote to memory of 2616	2752	A65C5D8268DAF8603D3F4861991CB09E.exe	78
PID 2752 wrote to memory of 2616	2752	A65C5D8268DAF8603D3F4861991CB09E.exe	78
PID 2752 wrote to memory of 2616	2752	A65C5D8268DAF8603D3F4861991CB09E.exe	78
PID 2752 wrote to memory of 2616	2752	A65C5D8268DAF8603D3F4861991CB09E.exe	78
PID 2616 wrote to memory of 412	2616	A65C5D8268DAF8603D3F4861991CB09E.exe	80
PID 2616 wrote to memory of 412	2616	A65C5D8268DAF8603D3F4861991CB09E.exe	80
PID 2616 wrote to memory of 412	2616	A65C5D8268DAF8603D3F4861991CB09E.exe	80
PID 2616 wrote to memory of 412	2616	A65C5D8268DAF8603D3F4861991CB09E.exe	80
PID 2616 wrote to memory of 412	2616	A65C5D8268DAF8603D3F4861991CB09E.exe	80
PID 2616 wrote to memory of 412	2616	A65C5D8268DAF8603D3F4861991CB09E.exe	80
PID 2616 wrote to memory of 412	2616	A65C5D8268DAF8603D3F4861991CB09E.exe	80
PID 2616 wrote to memory of 412	2616	A65C5D8268DAF8603D3F4861991CB09E.exe	80
PID 412 wrote to memory of 3408	412	A65C5D8268DAF8603D3F4861991CB09E.exe	81
PID 412 wrote to memory of 3408	412	A65C5D8268DAF8603D3F4861991CB09E.exe	81
PID 412 wrote to memory of 3408	412	A65C5D8268DAF8603D3F4861991CB09E.exe	81
PID 412 wrote to memory of 3408	412	A65C5D8268DAF8603D3F4861991CB09E.exe	81
PID 412 wrote to memory of 3408	412	A65C5D8268DAF8603D3F4861991CB09E.exe	81
PID 412 wrote to memory of 3408	412	A65C5D8268DAF8603D3F4861991CB09E.exe	81
PID 412 wrote to memory of 3408	412	A65C5D8268DAF8603D3F4861991CB09E.exe	81
PID 412 wrote to memory of 3408	412	A65C5D8268DAF8603D3F4861991CB09E.exe	81

C:\Users\Admin\AppData\Local\Temp\A65C5D8268DAF8603D3F4861991CB09E.exe
"C:\Users\Admin\AppData\Local\Temp\A65C5D8268DAF8603D3F4861991CB09E.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Local\Temp\A65C5D8268DAF8603D3F4861991CB09E.exe
  "C:\Users\Admin\AppData\Local\Temp\A65C5D8268DAF8603D3F4861991CB09E.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Users\Admin\AppData\Local\Temp\A65C5D8268DAF8603D3F4861991CB09E.exe
    -a "C:\Users\Admin\AppData\Local\16daf18d\plg\DWKm6RBW.json"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Users\Admin\AppData\Local\Temp\A65C5D8268DAF8603D3F4861991CB09E.exe
      -a "C:\Users\Admin\AppData\Local\Temp\unk.xml"
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

4

T1081

Discovery

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/412-122-0x0000000000400000-0x00000000008DC000-memory.dmp

Download

memory/412-118-0x0000000000400000-0x00000000008DC000-memory.dmp

Download

memory/2616-117-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/2616-114-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/2752-116-0x0000000004C00000-0x0000000004D73000-memory.dmp

Download

memory/3408-120-0x0000000000400000-0x00000000006FE000-memory.dmp

Download

memory/3408-126-0x0000000000400000-0x00000000006FE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads