bitrat | 9288f5f8898d70977cd45f6527ada3a36bdb76ae7accb3401b9c84189f18cc2c

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

copw.exe
Size

1.4MB
MD5

88992f8dbb079ae5f9754ed265c02f55
SHA1

c05d4025024da67569c53afabbdda51dabae6521
SHA256

9288f5f8898d70977cd45f6527ada3a36bdb76ae7accb3401b9c84189f18cc2c
SHA512

83e02f354a883fa35431b86e41c875e4b3ba4664ab60eb677273bda514b079a9d075a51c1c933106a2c3da330ac22599a4a4ecfaac4dc62a8f41806d698ed911

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

wer89.duckdns.org:2222

Attributes

communication_password
653d716345d8915046b904b90f41f271
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4284-130-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4284-134-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

copw.exe

pid process

4284 copw.exe
4284 copw.exe
4284 copw.exe
4284 copw.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

copw.exe

description pid process

Token: SeShutdownPrivilege 4284 copw.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

copw.exe

pid process

4284 copw.exe
4284 copw.exe

pid	process
4284	copw.exe
4284	copw.exe
4284	copw.exe
4284	copw.exe

description	pid	process
Token: SeShutdownPrivilege	4284	copw.exe

pid	process
4284	copw.exe
4284	copw.exe

C:\Users\Admin\AppData\Local\Temp\copw.exe
"C:\Users\Admin\AppData\Local\Temp\copw.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4284-130-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4284-131-0x00000000745C0000-0x00000000745F9000-memory.dmp

Filesize
228KB

Download
memory/4284-132-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/4284-133-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/4284-134-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4284-135-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/4284-136-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/4284-137-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/4284-138-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/4284-139-0x00000000745C0000-0x00000000745F9000-memory.dmp

Filesize
228KB

Download
memory/4284-140-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/4284-141-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/4284-142-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/4284-143-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/4284-144-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/4284-145-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/4284-146-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/4284-147-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/4284-148-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download