bitrat | 76c866501ffb3ed58214ba7949ddc13202e6c9e423c43e6ff690e548750386e7

General

Target

RequestORDERQuote.exe
Size

2.3MB
MD5

3f02190df38e5dadd7e1b694f547c539
SHA1

32769a00df7264940c155f9a2222812e0fbf86be
SHA256

91b24eab863880a23663f812e043b6b83dab1e658b234b1b98521e28071527b9
SHA512

5068205c43a7fc49fb1b0e1b48526181355e0af091b2086ab35e37a60dbb8d3136f5325b7b614402a9f52515a08e67d5255b195b71a5c5e5332a24098a9b24da

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.35

C2

vst.fastestmaking.com:5433

Attributes

communication_password
331316d4efb44682092a006307b9ae3a
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

RequestORDERQuote.exe

pid process

3336 RequestORDERQuote.exe
3336 RequestORDERQuote.exe
3336 RequestORDERQuote.exe
3336 RequestORDERQuote.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

RequestORDERQuote.exe

description pid process target process

PID 3824 set thread context of 3336 3824 RequestORDERQuote.exe RequestORDERQuote.exe

pid	process
3336	RequestORDERQuote.exe
3336	RequestORDERQuote.exe
3336	RequestORDERQuote.exe
3336	RequestORDERQuote.exe

description	pid	process	target process
PID 3824 set thread context of 3336	3824	RequestORDERQuote.exe	RequestORDERQuote.exe

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Modifies data under HKEY_USERS 47 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "3.124695"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132888115246693477"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4040"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3888"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.013122"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

RequestORDERQuote.exe

pid	process
3824	RequestORDERQuote.exe
3824	RequestORDERQuote.exe
3824	RequestORDERQuote.exe
3824	RequestORDERQuote.exe
3824	RequestORDERQuote.exe
3824	RequestORDERQuote.exe
3824	RequestORDERQuote.exe
3824	RequestORDERQuote.exe
3824	RequestORDERQuote.exe
3824	RequestORDERQuote.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RequestORDERQuote.exeRequestORDERQuote.exe

description pid process

Token: SeDebugPrivilege 3824 RequestORDERQuote.exe
Token: SeShutdownPrivilege 3336 RequestORDERQuote.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

RequestORDERQuote.exe

pid process

3336 RequestORDERQuote.exe
3336 RequestORDERQuote.exe

description	pid	process
Token: SeDebugPrivilege	3824	RequestORDERQuote.exe
Token: SeShutdownPrivilege	3336	RequestORDERQuote.exe

pid	process
3336	RequestORDERQuote.exe
3336	RequestORDERQuote.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

RequestORDERQuote.exe

description	pid	process	target process
PID 3824 wrote to memory of 1148	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 1148	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 1148	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 2892	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 2892	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 2892	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 3336	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 3336	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 3336	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 3336	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 3336	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 3336	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 3336	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 3336	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 3336	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 3336	3824	RequestORDERQuote.exe	RequestORDERQuote.exe
PID 3824 wrote to memory of 3336	3824	RequestORDERQuote.exe	RequestORDERQuote.exe

C:\Users\Admin\AppData\Local\Temp\RequestORDERQuote.exe
"C:\Users\Admin\AppData\Local\Temp\RequestORDERQuote.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824

C:\Users\Admin\AppData\Local\Temp\RequestORDERQuote.exe
C:\Users\Admin\AppData\Local\Temp\RequestORDERQuote.exe
2⤵
PID:1148

C:\Users\Admin\AppData\Local\Temp\RequestORDERQuote.exe
C:\Users\Admin\AppData\Local\Temp\RequestORDERQuote.exe
2⤵
PID:2892

C:\Users\Admin\AppData\Local\Temp\RequestORDERQuote.exe
C:\Users\Admin\AppData\Local\Temp\RequestORDERQuote.exe
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3336

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:3992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4056

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3336-135-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/3336-136-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/3824-130-0x0000000000DD0000-0x0000000001022000-memory.dmp

Filesize
2.3MB

Download
memory/3824-131-0x00000000060B0000-0x0000000006654000-memory.dmp

Filesize
5.6MB

Download
memory/3824-132-0x0000000005A40000-0x0000000005AD2000-memory.dmp

Filesize
584KB

Download
memory/3824-133-0x00000000032C0000-0x00000000032D1000-memory.dmp

Filesize
68KB

Download
memory/3824-134-0x00000000059D0000-0x00000000059DA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads