bitrat | 41ae4a22dbe73a3263a6556f0dd96a1e12909b23b69c9f93f3e86a5821aaa0ed

General

Target

tts_211.exe
Size

1.8MB
MD5

9a468b8d65c5e178f7f102aba60c098c
SHA1

b8ab231f494f2c158f433b1c213ef557492b5148
SHA256

41ae4a22dbe73a3263a6556f0dd96a1e12909b23b69c9f93f3e86a5821aaa0ed
SHA512

838c16f2942e1b0796e7ff440c6dd1f3e0266ab0d1ce0cb78798388aa13bff3c28d0ce8ffa13f202d3bbfaeedf15a722f04315f3ef6d2efb624fb342a25d84cb

Score

10^/10

bitrat suricata trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

volc.ddns.net:21501

Attributes

communication_password
d57285fa81b86687bf3a97dc3255ad98
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1908-59-0x00000000048C0000-0x0000000004A32000-memory.dmp	upx
behavioral1/memory/316-67-0x0000000000400000-0x00000000007E5000-memory.dmp	upx
behavioral1/memory/316-68-0x0000000000400000-0x00000000007E5000-memory.dmp	upx
behavioral1/memory/316-69-0x0000000000400000-0x00000000007E5000-memory.dmp	upx
behavioral1/memory/316-70-0x0000000000400000-0x00000000007E5000-memory.dmp	upx
behavioral1/memory/316-72-0x0000000000400000-0x00000000007E5000-memory.dmp	upx
behavioral1/memory/316-74-0x0000000000400000-0x00000000007E5000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
316	vbc.exe
316	vbc.exe
316	vbc.exe
316	vbc.exe
316	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1908 set thread context of 316	1908	tts_211.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1908	tts_211.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	tts_211.exe
Token: SeDebugPrivilege	316	vbc.exe
Token: SeShutdownPrivilege	316	vbc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
316	vbc.exe
316	vbc.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 772	1908	tts_211.exe	27
PID 1908 wrote to memory of 772	1908	tts_211.exe	27
PID 1908 wrote to memory of 772	1908	tts_211.exe	27
PID 1908 wrote to memory of 772	1908	tts_211.exe	27
PID 1908 wrote to memory of 772	1908	tts_211.exe	27
PID 1908 wrote to memory of 772	1908	tts_211.exe	27
PID 1908 wrote to memory of 772	1908	tts_211.exe	27
PID 1908 wrote to memory of 316	1908	tts_211.exe	28
PID 1908 wrote to memory of 316	1908	tts_211.exe	28
PID 1908 wrote to memory of 316	1908	tts_211.exe	28
PID 1908 wrote to memory of 316	1908	tts_211.exe	28
PID 1908 wrote to memory of 316	1908	tts_211.exe	28
PID 1908 wrote to memory of 316	1908	tts_211.exe	28
PID 1908 wrote to memory of 316	1908	tts_211.exe	28
PID 1908 wrote to memory of 316	1908	tts_211.exe	28
PID 1908 wrote to memory of 316	1908	tts_211.exe	28

C:\Users\Admin\AppData\Local\Temp\tts_211.exe
"C:\Users\Admin\AppData\Local\Temp\tts_211.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-66-0x0000000000400000-0x00000000007E5000-memory.dmp

Filesize
3.9MB

Download
memory/316-74-0x0000000000400000-0x00000000007E5000-memory.dmp

Filesize
3.9MB

Download
memory/316-73-0x0000000076731000-0x0000000076733000-memory.dmp

Filesize
8KB

Download
memory/316-72-0x0000000000400000-0x00000000007E5000-memory.dmp

Filesize
3.9MB

Download
memory/316-70-0x0000000000400000-0x00000000007E5000-memory.dmp

Filesize
3.9MB

Download
memory/316-69-0x0000000000400000-0x00000000007E5000-memory.dmp

Filesize
3.9MB

Download
memory/316-68-0x0000000000400000-0x00000000007E5000-memory.dmp

Filesize
3.9MB

Download
memory/316-67-0x0000000000400000-0x00000000007E5000-memory.dmp

Filesize
3.9MB

Download
memory/1908-59-0x00000000048C0000-0x0000000004A32000-memory.dmp

Filesize
1.4MB

Download
memory/1908-65-0x00000000076A0000-0x0000000007931000-memory.dmp

Filesize
2.6MB

Download
memory/1908-63-0x0000000000340000-0x0000000000377000-memory.dmp

Filesize
220KB

Download
memory/1908-62-0x0000000000320000-0x0000000000338000-memory.dmp

Filesize
96KB

Download
memory/1908-61-0x0000000000310000-0x000000000031B000-memory.dmp

Filesize
44KB

Download
memory/1908-60-0x0000000000300000-0x000000000030E000-memory.dmp

Filesize
56KB

Download
memory/1908-54-0x0000000001020000-0x0000000001021000-memory.dmp

Filesize
4KB

Download
memory/1908-58-0x0000000006240000-0x0000000006443000-memory.dmp

Filesize
2.0MB

Download
memory/1908-57-0x0000000004E20000-0x0000000004FC3000-memory.dmp

Filesize
1.6MB

Download
memory/1908-56-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/1908-55-0x00000000003E0000-0x00000000003E3000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing