bitrat | 01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426

General

Target

01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
Size

2.7MB
MD5

42efa39082d113d675bc63909a07d619
SHA1

71dd8678250e4bab3da90d3b0f51b5b444322a9e
SHA256

01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426
SHA512

965c70807905687a9bc801a52f9c8d986fa6bdf9ddf6505609423eece9df63235fc0332b7f68e392f19e030f1e2688a64b26443c4295163f0e51ce4aa7317321

Score

10^/10

bitrat persistence trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.35

C2

publiquilla.linkpc.net:9092

Attributes

communication_password
bfdba24ee3d61f0260c4dc1034c3ee43
install_dir
System32dllwin
install_file
Systemwin32077273dll.exe
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2656-126-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2656-128-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2656-129-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\Systemwin32077273dll = "C:\\Users\\Admin\\AppData\\Local\\System32dllwin\\Systemwin32077273dll.exe"	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2656	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
2656	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
2656	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
2656	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2544 set thread context of 2656	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	74

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe

Suspicious behavior: RenamesItself 7 IoCs

pid	Process
2656	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
2656	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
2656	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
2656	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
2656	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
2656	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
2656	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
Token: SeShutdownPrivilege	2656	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2656	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
2656	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2864	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	71
PID 2544 wrote to memory of 2864	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	71
PID 2544 wrote to memory of 2864	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	71
PID 2544 wrote to memory of 2872	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	72
PID 2544 wrote to memory of 2872	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	72
PID 2544 wrote to memory of 2872	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	72
PID 2544 wrote to memory of 3104	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	73
PID 2544 wrote to memory of 3104	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	73
PID 2544 wrote to memory of 3104	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	73
PID 2544 wrote to memory of 2656	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	74
PID 2544 wrote to memory of 2656	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	74
PID 2544 wrote to memory of 2656	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	74
PID 2544 wrote to memory of 2656	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	74
PID 2544 wrote to memory of 2656	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	74
PID 2544 wrote to memory of 2656	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	74
PID 2544 wrote to memory of 2656	2544	01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe	74

C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
"C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
  "C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe"
  2⤵
  PID:2864
- C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
  "C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe"
  2⤵
  PID:2872
- C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
  "C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe"
  2⤵
  PID:3104
- C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe
  "C:\Users\Admin\AppData\Local\Temp\01033e294faecb37e41c01525574ff033890eccc799175858049556e27e4b426.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2544-115-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/2544-117-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/2544-118-0x0000000005870000-0x0000000005871000-memory.dmp

Filesize
4KB

Download
memory/2544-119-0x0000000005370000-0x0000000005371000-memory.dmp

Filesize
4KB

Download
memory/2544-120-0x0000000005370000-0x000000000586E000-memory.dmp

Filesize
5.0MB

Download
memory/2544-121-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/2544-122-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/2544-123-0x0000000005210000-0x0000000005224000-memory.dmp

Filesize
80KB

Download
memory/2544-124-0x0000000006330000-0x000000000650C000-memory.dmp

Filesize
1.9MB

Download
memory/2544-125-0x00000000098D0000-0x0000000009A5D000-memory.dmp

Filesize
1.6MB

Download
memory/2656-126-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2656-128-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2656-129-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing