bitrat | e4cd8a1b9e5c53eae6da80b1d3bddaa3036f9fc7229d8a0d8307e3f4927d9349

General

Target

906704d57b43ab4f0cbb625b619c0524.exe
Size

4.1MB
MD5

906704d57b43ab4f0cbb625b619c0524
SHA1

5ffa166c080fc4207d5bf69a570256b090643dfb
SHA256

e4cd8a1b9e5c53eae6da80b1d3bddaa3036f9fc7229d8a0d8307e3f4927d9349
SHA512

11aecb4c157d0b3ad2ee733105efd3aad6f7852977a5d4a8ff62b60a8727ccc9c8ac3257babdebd4936131034e9bd9e01e93df7adc186be23b7f07f1b1e02d35

Score

10^/10

bitrat suricata trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

kimonda700.duckdns.org:5858

Attributes

communication_password
5604f45e9eedfa10a01bbe1ebda16726
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

906704d57b43ab4f0cbb625b619c0524.exe

pid	process
948	906704d57b43ab4f0cbb625b619c0524.exe
948	906704d57b43ab4f0cbb625b619c0524.exe
948	906704d57b43ab4f0cbb625b619c0524.exe
948	906704d57b43ab4f0cbb625b619c0524.exe
948	906704d57b43ab4f0cbb625b619c0524.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

906704d57b43ab4f0cbb625b619c0524.exe

description pid process target process

PID 1400 set thread context of 948 1400 906704d57b43ab4f0cbb625b619c0524.exe 906704d57b43ab4f0cbb625b619c0524.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

906704d57b43ab4f0cbb625b619c0524.exe

description pid process

Token: SeDebugPrivilege 948 906704d57b43ab4f0cbb625b619c0524.exe
Token: SeShutdownPrivilege 948 906704d57b43ab4f0cbb625b619c0524.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

906704d57b43ab4f0cbb625b619c0524.exe906704d57b43ab4f0cbb625b619c0524.exe

pid process

1400 906704d57b43ab4f0cbb625b619c0524.exe
948 906704d57b43ab4f0cbb625b619c0524.exe
948 906704d57b43ab4f0cbb625b619c0524.exe

description	pid	process	target process
PID 1400 set thread context of 948	1400	906704d57b43ab4f0cbb625b619c0524.exe	906704d57b43ab4f0cbb625b619c0524.exe

description	pid	process
Token: SeDebugPrivilege	948	906704d57b43ab4f0cbb625b619c0524.exe
Token: SeShutdownPrivilege	948	906704d57b43ab4f0cbb625b619c0524.exe

pid	process
1400	906704d57b43ab4f0cbb625b619c0524.exe
948	906704d57b43ab4f0cbb625b619c0524.exe
948	906704d57b43ab4f0cbb625b619c0524.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

906704d57b43ab4f0cbb625b619c0524.exe

description	pid	process	target process
PID 1400 wrote to memory of 948	1400	906704d57b43ab4f0cbb625b619c0524.exe	906704d57b43ab4f0cbb625b619c0524.exe
PID 1400 wrote to memory of 948	1400	906704d57b43ab4f0cbb625b619c0524.exe	906704d57b43ab4f0cbb625b619c0524.exe
PID 1400 wrote to memory of 948	1400	906704d57b43ab4f0cbb625b619c0524.exe	906704d57b43ab4f0cbb625b619c0524.exe
PID 1400 wrote to memory of 948	1400	906704d57b43ab4f0cbb625b619c0524.exe	906704d57b43ab4f0cbb625b619c0524.exe
PID 1400 wrote to memory of 948	1400	906704d57b43ab4f0cbb625b619c0524.exe	906704d57b43ab4f0cbb625b619c0524.exe
PID 1400 wrote to memory of 948	1400	906704d57b43ab4f0cbb625b619c0524.exe	906704d57b43ab4f0cbb625b619c0524.exe
PID 1400 wrote to memory of 948	1400	906704d57b43ab4f0cbb625b619c0524.exe	906704d57b43ab4f0cbb625b619c0524.exe
PID 1400 wrote to memory of 948	1400	906704d57b43ab4f0cbb625b619c0524.exe	906704d57b43ab4f0cbb625b619c0524.exe
PID 1400 wrote to memory of 948	1400	906704d57b43ab4f0cbb625b619c0524.exe	906704d57b43ab4f0cbb625b619c0524.exe
PID 1400 wrote to memory of 948	1400	906704d57b43ab4f0cbb625b619c0524.exe	906704d57b43ab4f0cbb625b619c0524.exe
PID 1400 wrote to memory of 948	1400	906704d57b43ab4f0cbb625b619c0524.exe	906704d57b43ab4f0cbb625b619c0524.exe
PID 1400 wrote to memory of 948	1400	906704d57b43ab4f0cbb625b619c0524.exe	906704d57b43ab4f0cbb625b619c0524.exe

C:\Users\Admin\AppData\Local\Temp\906704d57b43ab4f0cbb625b619c0524.exe
"C:\Users\Admin\AppData\Local\Temp\906704d57b43ab4f0cbb625b619c0524.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400

C:\Users\Admin\AppData\Local\Temp\906704d57b43ab4f0cbb625b619c0524.exe
"C:\Users\Admin\AppData\Local\Temp\906704d57b43ab4f0cbb625b619c0524.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-56-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/948-58-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/948-57-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/948-59-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/948-60-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/948-61-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/948-62-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/948-63-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/948-64-0x0000000076C91000-0x0000000076C93000-memory.dmp

Filesize
8KB

Download
memory/948-65-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing