bitrat | 39d1c62236097f35dbcb91310c722882def7fe38bf1d7803b15b879580e44d22

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20220414-en
submitted
08/07/2022, 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a667753900a6ec0b6339d02463d20b5c.exe
Size

3.0MB
MD5

a667753900a6ec0b6339d02463d20b5c
SHA1

fec54d99bb6b69581f1683a500bf7eccfa99541b
SHA256

39d1c62236097f35dbcb91310c722882def7fe38bf1d7803b15b879580e44d22
SHA512

c6e910d18309dbfad5cec1b0ef30bf887637dd62eac219632fc984aade0cd1deab6d366331441a57abfbf46ef617bd60bfa6dc630fb67fe78e5dfe00d0092e12

Score

10^/10

bitrat purecrypter loader persistence suricata trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

regidis.mooo.com:1234

Attributes

communication_password
202cb962ac59075b964b07152d234b70
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Detect PureCrypter loader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/1992-96-0x0000000009430000-0x00000000095F0000-memory.dmp	family_purecrypter

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Systemupdate\\WindowsFix.exe\","	a667753900a6ec0b6339d02463d20b5c.exe

PureCrypter
PureCrypter is a loader which is intended for downloading and executing additional payloads.
trojan loader purecrypter
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1404-106-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1404-108-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1404-109-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1404-112-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1404-111-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1404-113-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1404-114-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1404-118-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
1404	InstallUtil.exe
1404	InstallUtil.exe
1404	InstallUtil.exe
1404	InstallUtil.exe
1404	InstallUtil.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 1404	1992	a667753900a6ec0b6339d02463d20b5c.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 21 IoCs

evasion

pid	Process
1888	timeout.exe
1744	timeout.exe
1784	timeout.exe
1156	timeout.exe
964	timeout.exe
1064	timeout.exe
276	timeout.exe
1684	timeout.exe
828	timeout.exe
1716	timeout.exe
1540	timeout.exe
1536	timeout.exe
1696	timeout.exe
1400	timeout.exe
1984	timeout.exe
1696	timeout.exe
1740	timeout.exe
1900	timeout.exe
960	timeout.exe
1908	timeout.exe
1648	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2016	powershell.exe
1992	a667753900a6ec0b6339d02463d20b5c.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	a667753900a6ec0b6339d02463d20b5c.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	1404	InstallUtil.exe
Token: SeShutdownPrivilege	1404	InstallUtil.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1404	InstallUtil.exe
1404	InstallUtil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 992	1992	a667753900a6ec0b6339d02463d20b5c.exe	27
PID 1992 wrote to memory of 992	1992	a667753900a6ec0b6339d02463d20b5c.exe	27
PID 1992 wrote to memory of 992	1992	a667753900a6ec0b6339d02463d20b5c.exe	27
PID 1992 wrote to memory of 992	1992	a667753900a6ec0b6339d02463d20b5c.exe	27
PID 992 wrote to memory of 1744	992	cmd.exe	29
PID 992 wrote to memory of 1744	992	cmd.exe	29
PID 992 wrote to memory of 1744	992	cmd.exe	29
PID 992 wrote to memory of 1744	992	cmd.exe	29
PID 1992 wrote to memory of 1240	1992	a667753900a6ec0b6339d02463d20b5c.exe	30
PID 1992 wrote to memory of 1240	1992	a667753900a6ec0b6339d02463d20b5c.exe	30
PID 1992 wrote to memory of 1240	1992	a667753900a6ec0b6339d02463d20b5c.exe	30
PID 1992 wrote to memory of 1240	1992	a667753900a6ec0b6339d02463d20b5c.exe	30
PID 1240 wrote to memory of 1740	1240	cmd.exe	32
PID 1240 wrote to memory of 1740	1240	cmd.exe	32
PID 1240 wrote to memory of 1740	1240	cmd.exe	32
PID 1240 wrote to memory of 1740	1240	cmd.exe	32
PID 1992 wrote to memory of 852	1992	a667753900a6ec0b6339d02463d20b5c.exe	33
PID 1992 wrote to memory of 852	1992	a667753900a6ec0b6339d02463d20b5c.exe	33
PID 1992 wrote to memory of 852	1992	a667753900a6ec0b6339d02463d20b5c.exe	33
PID 1992 wrote to memory of 852	1992	a667753900a6ec0b6339d02463d20b5c.exe	33
PID 852 wrote to memory of 1784	852	cmd.exe	35
PID 852 wrote to memory of 1784	852	cmd.exe	35
PID 852 wrote to memory of 1784	852	cmd.exe	35
PID 852 wrote to memory of 1784	852	cmd.exe	35
PID 1992 wrote to memory of 684	1992	a667753900a6ec0b6339d02463d20b5c.exe	36
PID 1992 wrote to memory of 684	1992	a667753900a6ec0b6339d02463d20b5c.exe	36
PID 1992 wrote to memory of 684	1992	a667753900a6ec0b6339d02463d20b5c.exe	36
PID 1992 wrote to memory of 684	1992	a667753900a6ec0b6339d02463d20b5c.exe	36
PID 684 wrote to memory of 1696	684	cmd.exe	38
PID 684 wrote to memory of 1696	684	cmd.exe	38
PID 684 wrote to memory of 1696	684	cmd.exe	38
PID 684 wrote to memory of 1696	684	cmd.exe	38
PID 1992 wrote to memory of 780	1992	a667753900a6ec0b6339d02463d20b5c.exe	39
PID 1992 wrote to memory of 780	1992	a667753900a6ec0b6339d02463d20b5c.exe	39
PID 1992 wrote to memory of 780	1992	a667753900a6ec0b6339d02463d20b5c.exe	39
PID 1992 wrote to memory of 780	1992	a667753900a6ec0b6339d02463d20b5c.exe	39
PID 780 wrote to memory of 1156	780	cmd.exe	41
PID 780 wrote to memory of 1156	780	cmd.exe	41
PID 780 wrote to memory of 1156	780	cmd.exe	41
PID 780 wrote to memory of 1156	780	cmd.exe	41
PID 1992 wrote to memory of 1036	1992	a667753900a6ec0b6339d02463d20b5c.exe	42
PID 1992 wrote to memory of 1036	1992	a667753900a6ec0b6339d02463d20b5c.exe	42
PID 1992 wrote to memory of 1036	1992	a667753900a6ec0b6339d02463d20b5c.exe	42
PID 1992 wrote to memory of 1036	1992	a667753900a6ec0b6339d02463d20b5c.exe	42
PID 1036 wrote to memory of 964	1036	cmd.exe	44
PID 1036 wrote to memory of 964	1036	cmd.exe	44
PID 1036 wrote to memory of 964	1036	cmd.exe	44
PID 1036 wrote to memory of 964	1036	cmd.exe	44
PID 1992 wrote to memory of 1832	1992	a667753900a6ec0b6339d02463d20b5c.exe	45
PID 1992 wrote to memory of 1832	1992	a667753900a6ec0b6339d02463d20b5c.exe	45
PID 1992 wrote to memory of 1832	1992	a667753900a6ec0b6339d02463d20b5c.exe	45
PID 1992 wrote to memory of 1832	1992	a667753900a6ec0b6339d02463d20b5c.exe	45
PID 1832 wrote to memory of 1900	1832	cmd.exe	47
PID 1832 wrote to memory of 1900	1832	cmd.exe	47
PID 1832 wrote to memory of 1900	1832	cmd.exe	47
PID 1832 wrote to memory of 1900	1832	cmd.exe	47
PID 1992 wrote to memory of 2028	1992	a667753900a6ec0b6339d02463d20b5c.exe	48
PID 1992 wrote to memory of 2028	1992	a667753900a6ec0b6339d02463d20b5c.exe	48
PID 1992 wrote to memory of 2028	1992	a667753900a6ec0b6339d02463d20b5c.exe	48
PID 1992 wrote to memory of 2028	1992	a667753900a6ec0b6339d02463d20b5c.exe	48
PID 2028 wrote to memory of 1064	2028	cmd.exe	50
PID 2028 wrote to memory of 1064	2028	cmd.exe	50
PID 2028 wrote to memory of 1064	2028	cmd.exe	50
PID 2028 wrote to memory of 1064	2028	cmd.exe	50

C:\Users\Admin\AppData\Local\Temp\a667753900a6ec0b6339d02463d20b5c.exe
"C:\Users\Admin\AppData\Local\Temp\a667753900a6ec0b6339d02463d20b5c.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1064
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:1724
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:984
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:564
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:1748
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:112
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:276
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:1600
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:876
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:1720
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1540
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:1340
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:1884
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1536
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:1160
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:1336
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 10
  2⤵
  PID:1440
- - C:\Windows\SysWOW64\timeout.exe
    timeout 10
    3⤵
    - Delays execution with timeout.exe
    PID:1888
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABTAHkAcwB0AGUAbQB1AHAAZABhAHQAZQBcAFcAaQBuAGQAbwB3AHMARgBpAHgALgBlAHgAZQAnAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1404-116-0x0000000000150000-0x000000000015A000-memory.dmp

Filesize
40KB

Download
memory/1404-117-0x0000000000150000-0x000000000015A000-memory.dmp

Filesize
40KB

Download
memory/1404-106-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1404-105-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1404-109-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1404-112-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1404-119-0x0000000000150000-0x000000000015A000-memory.dmp

Filesize
40KB

Download
memory/1404-111-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1404-114-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1404-120-0x0000000000150000-0x000000000015A000-memory.dmp

Filesize
40KB

Download
memory/1404-108-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1404-113-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1404-118-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1992-98-0x0000000004CD0000-0x0000000004D1C000-memory.dmp

Filesize
304KB

Download
memory/1992-97-0x00000000072C0000-0x0000000007456000-memory.dmp

Filesize
1.6MB

Download
memory/1992-96-0x0000000009430000-0x00000000095F0000-memory.dmp

Filesize
1.8MB

Download
memory/1992-54-0x00000000008F0000-0x0000000000C00000-memory.dmp

Filesize
3.1MB

Download
memory/1992-55-0x0000000075DB1000-0x0000000075DB3000-memory.dmp

Filesize
8KB

Download
memory/2016-104-0x000000006F480000-0x000000006FA2B000-memory.dmp

Filesize
5.7MB

Download
memory/2016-103-0x000000006F480000-0x000000006FA2B000-memory.dmp

Filesize
5.7MB

Download