bitrat | 41ae4a22dbe73a3263a6556f0dd96a1e12909b23b69c9f93f3e86a5821aaa0ed

General

Target

tts_211.exe
Size

1.8MB
MD5

9a468b8d65c5e178f7f102aba60c098c
SHA1

b8ab231f494f2c158f433b1c213ef557492b5148
SHA256

41ae4a22dbe73a3263a6556f0dd96a1e12909b23b69c9f93f3e86a5821aaa0ed
SHA512

838c16f2942e1b0796e7ff440c6dd1f3e0266ab0d1ce0cb78798388aa13bff3c28d0ce8ffa13f202d3bbfaeedf15a722f04315f3ef6d2efb624fb342a25d84cb

Score

10^/10

bitrat suricata trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

volc.ddns.net:21501

Attributes

communication_password
d57285fa81b86687bf3a97dc3255ad98
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3880-121-0x00000000056D0000-0x0000000005842000-memory.dmp	upx
behavioral2/memory/1140-130-0x0000000000400000-0x00000000007E5000-memory.dmp	upx
behavioral2/memory/1140-134-0x0000000000400000-0x00000000007E5000-memory.dmp	upx
behavioral2/memory/1140-135-0x0000000000400000-0x00000000007E5000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
1140	csc.exe
1140	csc.exe
1140	csc.exe
1140	csc.exe
1140	csc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3880 set thread context of 1140	3880	tts_211.exe	69

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3880	tts_211.exe
3880	tts_211.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3880	tts_211.exe
Token: SeShutdownPrivilege	1140	csc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1140	csc.exe
1140	csc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 376	3880	tts_211.exe	68
PID 3880 wrote to memory of 376	3880	tts_211.exe	68
PID 3880 wrote to memory of 376	3880	tts_211.exe	68
PID 3880 wrote to memory of 1140	3880	tts_211.exe	69
PID 3880 wrote to memory of 1140	3880	tts_211.exe	69
PID 3880 wrote to memory of 1140	3880	tts_211.exe	69
PID 3880 wrote to memory of 1140	3880	tts_211.exe	69
PID 3880 wrote to memory of 1140	3880	tts_211.exe	69
PID 3880 wrote to memory of 1140	3880	tts_211.exe	69
PID 3880 wrote to memory of 1140	3880	tts_211.exe	69
PID 3880 wrote to memory of 1140	3880	tts_211.exe	69

C:\Users\Admin\AppData\Local\Temp\tts_211.exe
"C:\Users\Admin\AppData\Local\Temp\tts_211.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1140-130-0x0000000000400000-0x00000000007E5000-memory.dmp

Filesize
3.9MB

Download
memory/1140-135-0x0000000000400000-0x00000000007E5000-memory.dmp

Filesize
3.9MB

Download
memory/1140-134-0x0000000000400000-0x00000000007E5000-memory.dmp

Filesize
3.9MB

Download
memory/1140-133-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/1140-132-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3880-120-0x0000000005270000-0x0000000005473000-memory.dmp

Filesize
2.0MB

Download
memory/3880-129-0x0000000005940000-0x0000000005B53000-memory.dmp

Filesize
2.1MB

Download
memory/3880-124-0x00000000048E0000-0x00000000048EC000-memory.dmp

Filesize
48KB

Download
memory/3880-125-0x0000000005880000-0x0000000005881000-memory.dmp

Filesize
4KB

Download
memory/3880-126-0x0000000004920000-0x0000000004932000-memory.dmp

Filesize
72KB

Download
memory/3880-127-0x0000000004940000-0x000000000494B000-memory.dmp

Filesize
44KB

Download
memory/3880-128-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download
memory/3880-122-0x00000000048E0000-0x0000000004903000-memory.dmp

Filesize
140KB

Download
memory/3880-121-0x00000000056D0000-0x0000000005842000-memory.dmp

Filesize
1.4MB

Download
memory/3880-115-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/3880-119-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/3880-118-0x0000000004FC0000-0x0000000005163000-memory.dmp

Filesize
1.6MB

Download
memory/3880-117-0x0000000004DC0000-0x0000000004DC3000-memory.dmp

Filesize
12KB

Download
memory/3880-116-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing