bitrat | 06d093a1f7775df0391176bdee9e23b9856f95e0baa25c9d271e1854094235a2

General

Target

5a6bf2c5bcad6098f5eed902fd2ab165.exe
Size

2.6MB
MD5

5a6bf2c5bcad6098f5eed902fd2ab165
SHA1

169330abce1185aad9001fd590f8ea6952234a85
SHA256

06d093a1f7775df0391176bdee9e23b9856f95e0baa25c9d271e1854094235a2
SHA512

15821189aa69e7a35c6368c0898c7532f9cf43287ba4c6ace4c09885a2d175b9fbafc0cd6b463bfbc2ca721f1463a3904800fcee1133093d4802235072de35c1

Score

10^/10

bitrat persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

178.20.40.235:7777

Attributes

communication_password
90518ace97affc6b80a96099c2928d6a
install_dir
Temp
install_file
$77lsass.exe
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5a6bf2c5bcad6098f5eed902fd2ab165.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\$77lsass = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$77lsass.exe\uff00"	5a6bf2c5bcad6098f5eed902fd2ab165.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

Processes:

5a6bf2c5bcad6098f5eed902fd2ab165.exe

pid	process
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5a6bf2c5bcad6098f5eed902fd2ab165.exe

description pid process target process

PID 2728 set thread context of 3960 2728 5a6bf2c5bcad6098f5eed902fd2ab165.exe 5a6bf2c5bcad6098f5eed902fd2ab165.exe

description	pid	process	target process
PID 2728 set thread context of 3960	2728	5a6bf2c5bcad6098f5eed902fd2ab165.exe	5a6bf2c5bcad6098f5eed902fd2ab165.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5a6bf2c5bcad6098f5eed902fd2ab165.exe

pid	process
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

5a6bf2c5bcad6098f5eed902fd2ab165.exe

pid process

2728 5a6bf2c5bcad6098f5eed902fd2ab165.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

5a6bf2c5bcad6098f5eed902fd2ab165.exe

pid process

3960 5a6bf2c5bcad6098f5eed902fd2ab165.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5a6bf2c5bcad6098f5eed902fd2ab165.exe

description pid process

Token: SeShutdownPrivilege 3960 5a6bf2c5bcad6098f5eed902fd2ab165.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

5a6bf2c5bcad6098f5eed902fd2ab165.exe5a6bf2c5bcad6098f5eed902fd2ab165.exe

pid process

2728 5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960 5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960 5a6bf2c5bcad6098f5eed902fd2ab165.exe

pid	process
2728	5a6bf2c5bcad6098f5eed902fd2ab165.exe

description	pid	process
Token: SeShutdownPrivilege	3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe

pid	process
2728	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe
3960	5a6bf2c5bcad6098f5eed902fd2ab165.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5a6bf2c5bcad6098f5eed902fd2ab165.exe

description	pid	process	target process
PID 2728 wrote to memory of 3960	2728	5a6bf2c5bcad6098f5eed902fd2ab165.exe	5a6bf2c5bcad6098f5eed902fd2ab165.exe
PID 2728 wrote to memory of 3960	2728	5a6bf2c5bcad6098f5eed902fd2ab165.exe	5a6bf2c5bcad6098f5eed902fd2ab165.exe
PID 2728 wrote to memory of 3960	2728	5a6bf2c5bcad6098f5eed902fd2ab165.exe	5a6bf2c5bcad6098f5eed902fd2ab165.exe
PID 2728 wrote to memory of 3960	2728	5a6bf2c5bcad6098f5eed902fd2ab165.exe	5a6bf2c5bcad6098f5eed902fd2ab165.exe

C:\Users\Admin\AppData\Local\Temp\5a6bf2c5bcad6098f5eed902fd2ab165.exe
"C:\Users\Admin\AppData\Local\Temp\5a6bf2c5bcad6098f5eed902fd2ab165.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728

C:\Users\Admin\AppData\Local\Temp\5a6bf2c5bcad6098f5eed902fd2ab165.exe
"C:\Users\Admin\AppData\Local\Temp\5a6bf2c5bcad6098f5eed902fd2ab165.exe"
2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2728-135-0x000000000094A000-0x000000000094C000-memory.dmp

Filesize
8KB

Download
memory/2728-153-0x0000000000850000-0x0000000000852000-memory.dmp

Filesize
8KB

Download
memory/2728-119-0x000000000093C000-0x000000000093E000-memory.dmp

Filesize
8KB

Download
memory/2728-117-0x000000000093C000-0x000000000093E000-memory.dmp

Filesize
8KB

Download
memory/2728-121-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/2728-122-0x000000000093E000-0x0000000000943000-memory.dmp

Filesize
20KB

Download
memory/2728-123-0x000000000093E000-0x0000000000943000-memory.dmp

Filesize
20KB

Download
memory/2728-124-0x000000000093C000-0x000000000093E000-memory.dmp

Filesize
8KB

Download
memory/2728-125-0x0000000000947000-0x000000000094A000-memory.dmp

Filesize
12KB

Download
memory/2728-126-0x0000000000947000-0x000000000094A000-memory.dmp

Filesize
12KB

Download
memory/2728-127-0x000000000093E000-0x0000000000943000-memory.dmp

Filesize
20KB

Download
memory/2728-128-0x000000000094A000-0x000000000094C000-memory.dmp

Filesize
8KB

Download
memory/2728-129-0x000000000094A000-0x000000000094C000-memory.dmp

Filesize
8KB

Download
memory/2728-130-0x0000000000947000-0x000000000094A000-memory.dmp

Filesize
12KB

Download
memory/2728-131-0x0000000000947000-0x000000000094A000-memory.dmp

Filesize
12KB

Download
memory/2728-132-0x0000000000947000-0x000000000094A000-memory.dmp

Filesize
12KB

Download
memory/2728-133-0x000000000094A000-0x000000000094C000-memory.dmp

Filesize
8KB

Download
memory/2728-134-0x000000000094A000-0x000000000094C000-memory.dmp

Filesize
8KB

Download
memory/2728-120-0x000000000093C000-0x000000000093E000-memory.dmp

Filesize
8KB

Download
memory/2728-118-0x000000000093C000-0x000000000093E000-memory.dmp

Filesize
8KB

Download
memory/2728-139-0x000000000094A000-0x000000000094C000-memory.dmp

Filesize
8KB

Download
memory/2728-138-0x0000000000947000-0x000000000094A000-memory.dmp

Filesize
12KB

Download
memory/2728-140-0x000000000094A000-0x000000000094C000-memory.dmp

Filesize
8KB

Download
memory/2728-141-0x000000000094A000-0x000000000094C000-memory.dmp

Filesize
8KB

Download
memory/2728-142-0x0000000000947000-0x000000000094A000-memory.dmp

Filesize
12KB

Download
memory/2728-143-0x0000000000947000-0x000000000094A000-memory.dmp

Filesize
12KB

Download
memory/2728-144-0x0000000000947000-0x000000000094A000-memory.dmp

Filesize
12KB

Download
memory/2728-145-0x000000000094A000-0x000000000094C000-memory.dmp

Filesize
8KB

Download
memory/2728-146-0x000000000094A000-0x000000000094C000-memory.dmp

Filesize
8KB

Download
memory/2728-147-0x000000000094A000-0x000000000094C000-memory.dmp

Filesize
8KB

Download
memory/2728-148-0x0000000000947000-0x000000000094A000-memory.dmp

Filesize
12KB

Download
memory/2728-149-0x0000000000947000-0x000000000094A000-memory.dmp

Filesize
12KB

Download
memory/2728-150-0x0000000000947000-0x000000000094A000-memory.dmp

Filesize
12KB

Download
memory/2728-136-0x0000000000947000-0x000000000094A000-memory.dmp

Filesize
12KB

Download
memory/3960-154-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/3960-152-0x000000000068A488-mapping.dmp

Download
memory/3960-155-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads