bitrat | d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec

General

Target

d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe
Size

2.2MB
MD5

7545c015bd1feba22347fcbe6e5e0a86
SHA1

bcb1fd3b33f243ca8e2f3ac87e2700be8e04d002
SHA256

d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec
SHA512

505b1867673c86e654cdd369332bad493100fb37d9f24cbe91855c98c2d70022eea92ec0eff6ea52f8eb723096d2709cb87e15f55701d834d213bf72619d16ed

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.35

C2

publiquilla.linkpc.net:9096

Attributes

communication_password
bfdba24ee3d61f0260c4dc1034c3ee43
install_dir
antivirusscamdefenderlogss
install_file
antivirusscamdefenderlog.exe
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3012-125-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3012-126-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3012-127-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe

description	pid	process	target process
PID 2720 set thread context of 3012	2720	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe

description	pid	process	target process
PID 2720 wrote to memory of 3012	2720	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe
PID 2720 wrote to memory of 3012	2720	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe
PID 2720 wrote to memory of 3012	2720	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe
PID 2720 wrote to memory of 3012	2720	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe
PID 2720 wrote to memory of 3012	2720	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe
PID 2720 wrote to memory of 3012	2720	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe
PID 2720 wrote to memory of 3012	2720	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe	d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe

C:\Users\Admin\AppData\Local\Temp\d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe
"C:\Users\Admin\AppData\Local\Temp\d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2720

C:\Users\Admin\AppData\Local\Temp\d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe
"C:\Users\Admin\AppData\Local\Temp\d38c5450042d5abed1dc9fb3ad31dace57016abad7365d16aab59982c61b9fec.exe"
2⤵
PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2720-115-0x00000000006C0000-0x00000000008EE000-memory.dmp

Filesize
2.2MB

Download
memory/2720-116-0x0000000005140000-0x00000000051DC000-memory.dmp

Filesize
624KB

Download
memory/2720-117-0x00000000056E0000-0x0000000005BDE000-memory.dmp

Filesize
5.0MB

Download
memory/2720-118-0x00000000051E0000-0x0000000005272000-memory.dmp

Filesize
584KB

Download
memory/2720-119-0x00000000051E0000-0x00000000056DE000-memory.dmp

Filesize
5.0MB

Download
memory/2720-120-0x00000000050F0000-0x00000000050FA000-memory.dmp

Filesize
40KB

Download
memory/2720-121-0x0000000005400000-0x0000000005456000-memory.dmp

Filesize
344KB

Download
memory/2720-122-0x0000000005380000-0x0000000005394000-memory.dmp

Filesize
80KB

Download
memory/2720-123-0x0000000006250000-0x000000000643C000-memory.dmp

Filesize
1.9MB

Download
memory/2720-124-0x0000000009820000-0x00000000099BC000-memory.dmp

Filesize
1.6MB

Download
memory/3012-125-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3012-126-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3012-127-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads