bitrat | a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868 | Triage

Analysis

max time kernel
145s
max time network
143s
platform
windows7_x64
resource
win7-20220414-en
submitted
30-06-2022 16:58

Sharing

Report Analysis Logs

General

Target

a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe
Size

2.7MB
MD5

720e206fa0d50d62798c7e05e65c9333
SHA1

74f37097a796b81bc052a3f91cb4b7d7d9a06cbe
SHA256

a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868
SHA512

94fa380fbee91313d314a4342482ea5f916fa05de340653924ba09d0e858109880106ce62f95d6f832ba4a29920c97c5705d7981fcb0720f19a586281c2d70db

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.33

C2

23.105.131.186:8787

Attributes

communication_password
c4ca4238a0b923820dcc509a6f75849b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1380-58-0x0000000000400000-0x00000000007D7000-memory.dmp	upx
behavioral1/memory/1380-60-0x0000000000400000-0x00000000007D7000-memory.dmp	upx
behavioral1/memory/1380-61-0x0000000000400000-0x00000000007D7000-memory.dmp	upx
behavioral1/memory/1380-63-0x0000000000400000-0x00000000007D7000-memory.dmp	upx
behavioral1/memory/1380-64-0x0000000000400000-0x00000000007D7000-memory.dmp	upx
behavioral1/memory/1380-65-0x0000000000400000-0x00000000007D7000-memory.dmp	upx
behavioral1/memory/1380-68-0x0000000000400000-0x00000000007D7000-memory.dmp	upx
behavioral1/memory/1380-69-0x0000000000400000-0x00000000007D7000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe

pid	process
1380	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe
1380	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe
1380	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe
1380	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe

description	pid	process	target process
PID 1672 set thread context of 1380	1672	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe

description	pid	process
Token: SeDebugPrivilege	1380	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe
Token: SeShutdownPrivilege	1380	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe

pid	process
1380	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe
1380	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe

description	pid	process	target process
PID 1672 wrote to memory of 1380	1672	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe
PID 1672 wrote to memory of 1380	1672	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe
PID 1672 wrote to memory of 1380	1672	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe
PID 1672 wrote to memory of 1380	1672	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe
PID 1672 wrote to memory of 1380	1672	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe
PID 1672 wrote to memory of 1380	1672	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe
PID 1672 wrote to memory of 1380	1672	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe
PID 1672 wrote to memory of 1380	1672	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe	a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe

C:\Users\Admin\AppData\Local\Temp\a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe
"C:\Users\Admin\AppData\Local\Temp\a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1672

C:\Users\Admin\AppData\Local\Temp\a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe
"C:\Users\Admin\AppData\Local\Temp\a7408b998eae536b93af0d084d1d255670c91fcdd568e9f42b15e301108b8868.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-62-0x00000000007D5220-mapping.dmp

Download
memory/1380-63-0x0000000000400000-0x00000000007D7000-memory.dmp

Filesize
3.8MB

Download
memory/1380-69-0x0000000000400000-0x00000000007D7000-memory.dmp

Filesize
3.8MB

Download
memory/1380-57-0x0000000000400000-0x00000000007D7000-memory.dmp

Filesize
3.8MB

Download
memory/1380-58-0x0000000000400000-0x00000000007D7000-memory.dmp

Filesize
3.8MB

Download
memory/1380-60-0x0000000000400000-0x00000000007D7000-memory.dmp

Filesize
3.8MB

Download
memory/1380-68-0x0000000000400000-0x00000000007D7000-memory.dmp

Filesize
3.8MB

Download
memory/1380-65-0x0000000000400000-0x00000000007D7000-memory.dmp

Filesize
3.8MB

Download
memory/1380-61-0x0000000000400000-0x00000000007D7000-memory.dmp

Filesize
3.8MB

Download
memory/1380-64-0x0000000000400000-0x00000000007D7000-memory.dmp

Filesize
3.8MB

Download
memory/1672-66-0x0000000074460000-0x0000000074A0B000-memory.dmp

Filesize
5.7MB

Download
memory/1672-54-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/1672-55-0x0000000074460000-0x0000000074A0B000-memory.dmp

Filesize
5.7MB

Download
memory/1672-56-0x0000000074460000-0x0000000074A0B000-memory.dmp

Filesize
5.7MB

Download