bitrat | 39d180e2f5c447706ad8e4f2fc0a86c2cbd586426dd1343f37f3008569f1a60b

Analysis

max time kernel
147s
max time network
151s
platform
windows7_x64
resource
win7-20220331-en
submitted
12/04/2022, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
58b756316b232975a709148b774bd66c.exe
Size 3.1MB
Sample220412-pwrtsaefa2
SHA256 39d180e2f5c447706ad8e4f2fc0a86c2cbd586426dd1343f37f3008569f1a60b
MD5 58b756316b232975a709148b774bd66c
SHA1 4263dc71f89dfba45d79647d5ca73cd7841b039b
SHA512 65b3b7ac35b0dd92ca85ce08d521e05d66009ee7c3de8dc9663013855c064e936f1c6848e261b7aa953cb3d77acfdc433906d5d201955daea29187e4b301c6a8
MD5 SHA1 SHA512

Score

10^/10

bitrat persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

212.193.30.54:3680

Attributes

communication_password
46821e93230f353d5c46240b0462a0fe
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jrdpln = "\"C:\\Users\\Admin\\AppData\\Roaming\\Nhuydlj\\Jrdpln.exe\""	58b756316b232975a709148b774bd66c.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
1948	InstallUtil.exe
1948	InstallUtil.exe
1948	InstallUtil.exe
1948	InstallUtil.exe
1948	InstallUtil.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 1948	1756	58b756316b232975a709148b774bd66c.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1720	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1756	58b756316b232975a709148b774bd66c.exe
1756	58b756316b232975a709148b774bd66c.exe
1756	58b756316b232975a709148b774bd66c.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	58b756316b232975a709148b774bd66c.exe
Token: SeDebugPrivilege	1948	InstallUtil.exe
Token: SeShutdownPrivilege	1948	InstallUtil.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1948	InstallUtil.exe
1948	InstallUtil.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1692	1756	58b756316b232975a709148b774bd66c.exe	28
PID 1756 wrote to memory of 1692	1756	58b756316b232975a709148b774bd66c.exe	28
PID 1756 wrote to memory of 1692	1756	58b756316b232975a709148b774bd66c.exe	28
PID 1756 wrote to memory of 1692	1756	58b756316b232975a709148b774bd66c.exe	28
PID 1692 wrote to memory of 1720	1692	cmd.exe	30
PID 1692 wrote to memory of 1720	1692	cmd.exe	30
PID 1692 wrote to memory of 1720	1692	cmd.exe	30
PID 1692 wrote to memory of 1720	1692	cmd.exe	30
PID 1756 wrote to memory of 1360	1756	58b756316b232975a709148b774bd66c.exe	31
PID 1756 wrote to memory of 1360	1756	58b756316b232975a709148b774bd66c.exe	31
PID 1756 wrote to memory of 1360	1756	58b756316b232975a709148b774bd66c.exe	31
PID 1756 wrote to memory of 1360	1756	58b756316b232975a709148b774bd66c.exe	31
PID 1756 wrote to memory of 1360	1756	58b756316b232975a709148b774bd66c.exe	31
PID 1756 wrote to memory of 1360	1756	58b756316b232975a709148b774bd66c.exe	31
PID 1756 wrote to memory of 1360	1756	58b756316b232975a709148b774bd66c.exe	31
PID 1756 wrote to memory of 1948	1756	58b756316b232975a709148b774bd66c.exe	32
PID 1756 wrote to memory of 1948	1756	58b756316b232975a709148b774bd66c.exe	32
PID 1756 wrote to memory of 1948	1756	58b756316b232975a709148b774bd66c.exe	32
PID 1756 wrote to memory of 1948	1756	58b756316b232975a709148b774bd66c.exe	32
PID 1756 wrote to memory of 1948	1756	58b756316b232975a709148b774bd66c.exe	32
PID 1756 wrote to memory of 1948	1756	58b756316b232975a709148b774bd66c.exe	32
PID 1756 wrote to memory of 1948	1756	58b756316b232975a709148b774bd66c.exe	32
PID 1756 wrote to memory of 1948	1756	58b756316b232975a709148b774bd66c.exe	32
PID 1756 wrote to memory of 1948	1756	58b756316b232975a709148b774bd66c.exe	32
PID 1756 wrote to memory of 1948	1756	58b756316b232975a709148b774bd66c.exe	32
PID 1756 wrote to memory of 1948	1756	58b756316b232975a709148b774bd66c.exe	32
PID 1756 wrote to memory of 1948	1756	58b756316b232975a709148b774bd66c.exe	32
PID 1756 wrote to memory of 1948	1756	58b756316b232975a709148b774bd66c.exe	32
PID 1756 wrote to memory of 1948	1756	58b756316b232975a709148b774bd66c.exe	32
PID 1756 wrote to memory of 1948	1756	58b756316b232975a709148b774bd66c.exe	32

C:\Users\Admin\AppData\Local\Temp\58b756316b232975a709148b774bd66c.exe
"C:\Users\Admin\AppData\Local\Temp\58b756316b232975a709148b774bd66c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 36
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\timeout.exe
    timeout 36
    3⤵
    - Delays execution with timeout.exe
    PID:1720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  PID:1360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-54-0x0000000000140000-0x0000000000464000-memory.dmp

Download

memory/1756-55-0x0000000005DF0000-0x0000000006102000-memory.dmp

Download

memory/1756-58-0x0000000008B20000-0x0000000008D14000-memory.dmp

Download

memory/1948-64-0x0000000000400000-0x00000000007CE000-memory.dmp

Download

memory/1948-60-0x0000000000400000-0x00000000007CE000-memory.dmp

Download

memory/1948-62-0x0000000000400000-0x00000000007CE000-memory.dmp

Download

memory/1948-59-0x0000000000400000-0x00000000007CE000-memory.dmp

Download

memory/1948-66-0x0000000000400000-0x00000000007CE000-memory.dmp

Download

memory/1948-68-0x0000000000400000-0x00000000007CE000-memory.dmp

Download

memory/1948-69-0x0000000000400000-0x00000000007CE000-memory.dmp

Download

memory/1948-71-0x0000000000400000-0x00000000007CE000-memory.dmp

Download

memory/1948-74-0x0000000000400000-0x00000000007CE000-memory.dmp

Download

memory/1948-75-0x0000000075E71000-0x0000000075E73000-memory.dmp

Download