bitrat | f8740b5ac23ccea3c9041197ea5a63e2afdbd83515155cfc5567fba9b4ea434e

General

Target

importante boleta cita fisca.exe
Size

112KB
MD5

9af009465f81dd21e95c471f1cfcd4cb
SHA1

46a82157ffff18e722ec9bd9c6563b2daea7f05a
SHA256

f8740b5ac23ccea3c9041197ea5a63e2afdbd83515155cfc5567fba9b4ea434e
SHA512

3473591a4ae75f57859de9609ca0e16c9283b7ffcb603b29d410208a39fff1ce3d3284c3105b0d9062d1ba33a1e90029cbd72f07f3bad74820fe9b625aba8935

Score

10^/10

bitrat persistence suricata trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

ejuejehth.con-ip.com:1880

Attributes

communication_password
202cb962ac59075b964b07152d234b70
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/820-69-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/820-71-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/820-72-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/820-74-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/820-75-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/820-76-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/820-78-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/820-81-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

importante boleta cita fisca.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Mklwxcw\\chrome.exe\""	importante boleta cita fisca.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

InstallUtil.exe

pid process

820 InstallUtil.exe
820 InstallUtil.exe
820 InstallUtil.exe
820 InstallUtil.exe
820 InstallUtil.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

importante boleta cita fisca.exe

description pid process target process

PID 304 set thread context of 820 304 importante boleta cita fisca.exe InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exeimportante boleta cita fisca.exe

pid process

2000 powershell.exe
1756 powershell.exe
304 importante boleta cita fisca.exe

pid	process
820	InstallUtil.exe
820	InstallUtil.exe
820	InstallUtil.exe
820	InstallUtil.exe
820	InstallUtil.exe

description	pid	process	target process
PID 304 set thread context of 820	304	importante boleta cita fisca.exe	InstallUtil.exe

pid	process
2000	powershell.exe
1756	powershell.exe
304	importante boleta cita fisca.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exeimportante boleta cita fisca.exepowershell.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	304	importante boleta cita fisca.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	820	InstallUtil.exe
Token: SeShutdownPrivilege	820	InstallUtil.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

InstallUtil.exe

pid process

820 InstallUtil.exe
820 InstallUtil.exe

pid	process
820	InstallUtil.exe
820	InstallUtil.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

importante boleta cita fisca.exe

description	pid	process	target process
PID 304 wrote to memory of 2000	304	importante boleta cita fisca.exe	powershell.exe
PID 304 wrote to memory of 2000	304	importante boleta cita fisca.exe	powershell.exe
PID 304 wrote to memory of 2000	304	importante boleta cita fisca.exe	powershell.exe
PID 304 wrote to memory of 2000	304	importante boleta cita fisca.exe	powershell.exe
PID 304 wrote to memory of 1756	304	importante boleta cita fisca.exe	powershell.exe
PID 304 wrote to memory of 1756	304	importante boleta cita fisca.exe	powershell.exe
PID 304 wrote to memory of 1756	304	importante boleta cita fisca.exe	powershell.exe
PID 304 wrote to memory of 1756	304	importante boleta cita fisca.exe	powershell.exe
PID 304 wrote to memory of 820	304	importante boleta cita fisca.exe	InstallUtil.exe
PID 304 wrote to memory of 820	304	importante boleta cita fisca.exe	InstallUtil.exe
PID 304 wrote to memory of 820	304	importante boleta cita fisca.exe	InstallUtil.exe
PID 304 wrote to memory of 820	304	importante boleta cita fisca.exe	InstallUtil.exe
PID 304 wrote to memory of 820	304	importante boleta cita fisca.exe	InstallUtil.exe
PID 304 wrote to memory of 820	304	importante boleta cita fisca.exe	InstallUtil.exe
PID 304 wrote to memory of 820	304	importante boleta cita fisca.exe	InstallUtil.exe
PID 304 wrote to memory of 820	304	importante boleta cita fisca.exe	InstallUtil.exe
PID 304 wrote to memory of 820	304	importante boleta cita fisca.exe	InstallUtil.exe
PID 304 wrote to memory of 820	304	importante boleta cita fisca.exe	InstallUtil.exe
PID 304 wrote to memory of 820	304	importante boleta cita fisca.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\importante boleta cita fisca.exe
"C:\Users\Admin\AppData\Local\Temp\importante boleta cita fisca.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:304

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
5a72c46e3d2747228ea825da64001561

SHA1
3b9b361eae9c1d6fc098f13050eb5dab73e054a7

SHA256
cabb9ade8f7550023d60b38aa8f4775fd1c5adc09b52e4a3b484280b24d6968e

SHA512
0cb2bc816f529c92b68bec513cd1449ec36e7eec2b4538491ee494a24e61acb29e72a59bc74186f0335938fe7582f19955585b8e8ed57199c1101fcab34cb561

Download Submit
memory/304-60-0x00000000083B0000-0x00000000085DA000-memory.dmp

Filesize
2.2MB

Download
memory/304-55-0x0000000075DB1000-0x0000000075DB3000-memory.dmp

Filesize
8KB

Download
memory/304-54-0x0000000000A00000-0x0000000000A20000-memory.dmp

Filesize
128KB

Download
memory/304-61-0x0000000004E70000-0x0000000004EBC000-memory.dmp

Filesize
304KB

Download
memory/820-68-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/820-79-0x0000000000110000-0x000000000011A000-memory.dmp

Filesize
40KB

Download
memory/820-82-0x0000000000110000-0x000000000011A000-memory.dmp

Filesize
40KB

Download
memory/820-83-0x0000000000110000-0x000000000011A000-memory.dmp

Filesize
40KB

Download
memory/820-81-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/820-80-0x0000000000110000-0x000000000011A000-memory.dmp

Filesize
40KB

Download
memory/820-78-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/820-76-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/820-69-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/820-71-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/820-73-0x00000000007E2730-mapping.dmp

Download
memory/820-72-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/820-74-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/820-75-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1756-67-0x000000006F540000-0x000000006FAEB000-memory.dmp

Filesize
5.7MB

Download
memory/1756-66-0x000000006F540000-0x000000006FAEB000-memory.dmp

Filesize
5.7MB

Download
memory/1756-65-0x000000006F540000-0x000000006FAEB000-memory.dmp

Filesize
5.7MB

Download
memory/1756-62-0x0000000000000000-mapping.dmp

Download
memory/2000-56-0x0000000000000000-mapping.dmp

Download
memory/2000-59-0x000000006F540000-0x000000006FAEB000-memory.dmp

Filesize
5.7MB

Download
memory/2000-58-0x000000006F540000-0x000000006FAEB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads