bitrat | a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd

General

Target

a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe
Size

2.0MB
MD5

81ef454de5367209d2c791fa6b1c8dd7
SHA1

32a1569c1c30e0241461df8128a86e0bdae26797
SHA256

a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd
SHA512

18b2922b89526b5edb235d95b2337ab481c8ce773f431627662e18f49713c15dc291c56eac1c66ba7d534df779a74fd59b9111d304d12aced8144d41986198a9

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.35

C2

publiquilla.linkpc.net:9097

Attributes

communication_password
bfdba24ee3d61f0260c4dc1034c3ee43
install_dir
System320772736e3b1d119b3
install_file
System320772736e3b1d119b.exe
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/956-58-0x0000000000270000-0x000000000027C000-memory.dmp	CustAttr

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1828-62-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1828-63-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1828-64-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1828-65-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1828-67-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe

pid process

1828 a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe

pid	process
1828	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe

description	pid	process	target process
PID 956 set thread context of 1828	956	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe

description	pid	process
Token: SeDebugPrivilege	1828	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe
Token: SeShutdownPrivilege	1828	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe

description	pid	process	target process
PID 956 wrote to memory of 1828	956	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe
PID 956 wrote to memory of 1828	956	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe
PID 956 wrote to memory of 1828	956	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe
PID 956 wrote to memory of 1828	956	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe
PID 956 wrote to memory of 1828	956	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe
PID 956 wrote to memory of 1828	956	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe
PID 956 wrote to memory of 1828	956	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe
PID 956 wrote to memory of 1828	956	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe	a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe

C:\Users\Admin\AppData\Local\Temp\a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe
"C:\Users\Admin\AppData\Local\Temp\a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:956

C:\Users\Admin\AppData\Local\Temp\a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe
"C:\Users\Admin\AppData\Local\Temp\a3b875701db56862b5acc2a1eda8db1a30f5e0617780973154a352ab4a662bdd.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-55-0x0000000001140000-0x000000000133C000-memory.dmp

Filesize
2.0MB

Download
memory/956-56-0x00000000763B1000-0x00000000763B3000-memory.dmp

Filesize
8KB

Download
memory/956-57-0x0000000000F20000-0x0000000000F21000-memory.dmp

Filesize
4KB

Download
memory/956-58-0x0000000000270000-0x000000000027C000-memory.dmp

Filesize
48KB

Download
memory/956-59-0x0000000005730000-0x0000000005900000-memory.dmp

Filesize
1.8MB

Download
memory/956-60-0x0000000008C80000-0x0000000008DFE000-memory.dmp

Filesize
1.5MB

Download
memory/1828-61-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1828-62-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1828-63-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1828-64-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1828-65-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1828-67-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1828-68-0x0000000000401000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads