bitrat | 34f7951c85471bb09b591acb859d5482161ee48e9f9d2f2280af698e6d16d5f0

Resubmissions

10/03/2022, 02:15

220310-cpkexaffhn10

09/03/2022, 22:48

220309-2raqxsefhn10

09/03/2022, 22:38

220309-2kg7esbgg98

Analysis

max time kernel
593s
max time network
599s
platform
windows10_x64
resource
win10-20220223-en
submitted
09/03/2022, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invoice.exe
Size 300.0MB
Sample220309-2raqxsefhn
SHA256 34f7951c85471bb09b591acb859d5482161ee48e9f9d2f2280af698e6d16d5f0
MD5 6d70caca7e926a8d9bd590b989f35e46
SHA1 6f85cbfc708b3367569daab627c1b21fda9fb3b8
SHA512 576d125f55b846ac2adf978e0ed5df322e15c5f8cf33995fd61e27db3c7a2ca5e913d19a145bce24a1eb52a4520616fb1cbc4786b2758ee991f0470fdabf683e
MD5 SHA1 SHA512

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

page1bit.duckdns.org:2022

Attributes

communication_password
827ccb0eea8a706c4c34a16891f84e7b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Executes dropped EXE 1 IoCs

pid	Process
3996	windows.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2004-121-0x0000000000700000-0x0000000000AE4000-memory.dmp	upx
behavioral2/memory/2004-122-0x0000000000700000-0x0000000000AE4000-memory.dmp	upx
behavioral2/memory/2896-128-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2896-129-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2896-130-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2896-131-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2896-132-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2896	RegAsm.exe
2896	RegAsm.exe
2896	RegAsm.exe
2896	RegAsm.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2508 set thread context of 2004	2508	Invoice.exe	44
PID 3996 set thread context of 2896	3996	windows.exe	55

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3980	2004	WerFault.exe	44

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3700	schtasks.exe
864	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	Invoice.exe
Token: SeDebugPrivilege	3996	windows.exe
Token: SeShutdownPrivilege	2896	RegAsm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2896	RegAsm.exe
2896	RegAsm.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2004	2508	Invoice.exe	44
PID 2508 wrote to memory of 2004	2508	Invoice.exe	44
PID 2508 wrote to memory of 2004	2508	Invoice.exe	44
PID 2508 wrote to memory of 2004	2508	Invoice.exe	44
PID 2508 wrote to memory of 2004	2508	Invoice.exe	44
PID 2508 wrote to memory of 2004	2508	Invoice.exe	44
PID 2508 wrote to memory of 2004	2508	Invoice.exe	44
PID 2508 wrote to memory of 3916	2508	Invoice.exe	45
PID 2508 wrote to memory of 3916	2508	Invoice.exe	45
PID 2508 wrote to memory of 3916	2508	Invoice.exe	45
PID 2508 wrote to memory of 988	2508	Invoice.exe	47
PID 2508 wrote to memory of 988	2508	Invoice.exe	47
PID 2508 wrote to memory of 988	2508	Invoice.exe	47
PID 2508 wrote to memory of 3936	2508	Invoice.exe	49
PID 2508 wrote to memory of 3936	2508	Invoice.exe	49
PID 2508 wrote to memory of 3936	2508	Invoice.exe	49
PID 988 wrote to memory of 3700	988	cmd.exe	52
PID 988 wrote to memory of 3700	988	cmd.exe	52
PID 988 wrote to memory of 3700	988	cmd.exe	52
PID 3996 wrote to memory of 2896	3996	windows.exe	55
PID 3996 wrote to memory of 2896	3996	windows.exe	55
PID 3996 wrote to memory of 2896	3996	windows.exe	55
PID 3996 wrote to memory of 2896	3996	windows.exe	55
PID 3996 wrote to memory of 2896	3996	windows.exe	55
PID 3996 wrote to memory of 2896	3996	windows.exe	55
PID 3996 wrote to memory of 2896	3996	windows.exe	55
PID 3996 wrote to memory of 4076	3996	windows.exe	56
PID 3996 wrote to memory of 4076	3996	windows.exe	56
PID 3996 wrote to memory of 4076	3996	windows.exe	56
PID 3996 wrote to memory of 3828	3996	windows.exe	58
PID 3996 wrote to memory of 3828	3996	windows.exe	58
PID 3996 wrote to memory of 3828	3996	windows.exe	58
PID 3996 wrote to memory of 444	3996	windows.exe	59
PID 3996 wrote to memory of 444	3996	windows.exe	59
PID 3996 wrote to memory of 444	3996	windows.exe	59
PID 3828 wrote to memory of 864	3828	cmd.exe	62
PID 3828 wrote to memory of 864	3828	cmd.exe	62
PID 3828 wrote to memory of 864	3828	cmd.exe	62

C:\Users\Admin\AppData\Local\Temp\Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 568
    3⤵
    - Program crash
    PID:3980
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\windows"
  2⤵
  PID:3916
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\windows\windows.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\windows\windows.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:3700
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\Invoice.exe" "C:\Users\Admin\AppData\Roaming\windows\windows.exe"
  2⤵
  PID:3936

C:\Users\Admin\AppData\Roaming\windows\windows.exe
C:\Users\Admin\AppData\Roaming\windows\windows.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2896
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\windows"
  2⤵
  PID:4076
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\windows\windows.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\windows\windows.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:864
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Roaming\windows\windows.exe" "C:\Users\Admin\AppData\Roaming\windows\windows.exe"
  2⤵
  PID:444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-121-0x0000000000700000-0x0000000000AE4000-memory.dmp

Download

memory/2004-122-0x0000000000700000-0x0000000000AE4000-memory.dmp

Download

memory/2508-117-0x0000000073730000-0x0000000073E1E000-memory.dmp

Download

memory/2508-119-0x00000000053D0000-0x00000000053DA000-memory.dmp

Download

memory/2508-114-0x0000000000AF0000-0x0000000000CC4000-memory.dmp

Download

memory/2508-118-0x0000000005520000-0x0000000005521000-memory.dmp

Download

memory/2508-116-0x0000000005410000-0x00000000054A2000-memory.dmp

Download

memory/2508-115-0x0000000005A30000-0x0000000005F2E000-memory.dmp

Download

memory/2896-129-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/2896-128-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/2896-130-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/2896-131-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/2896-132-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3996-125-0x0000000073730000-0x0000000073E1E000-memory.dmp

Download

memory/3996-127-0x0000000002D00000-0x0000000002D01000-memory.dmp

Download

memory/3996-126-0x0000000001090000-0x0000000001264000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads