bitrat | 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad

General

Target

44e041dc2e445fcd33cc89b8453d0539.exe
Size

1.4MB
MD5

44e041dc2e445fcd33cc89b8453d0539
SHA1

99faf5ac243f30d7041e7018f41490023b552f60
SHA256

707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad
SHA512

893019fd4b969250464a551bdeb0fc050da5bc82f1680b5ef116e8cc43b2e0b4088ec351f91d0d4b379ffd61fb32a02a34ea11fb94ca35fc4ed064dda021bf18

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

trotox.duckdns.org:55441

Attributes

communication_password
4b49ee1f55b1900518dfb23fd2d7c702
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3736-130-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3736-133-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3736-140-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4812-142-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4232-143-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4808-144-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4808-147-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4812-148-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4232-150-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

44e041dc2e445fcd33cc89b8453d0539.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	44e041dc2e445fcd33cc89b8453d0539.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

Processes:

44e041dc2e445fcd33cc89b8453d0539.exe44e041dc2e445fcd33cc89b8453d0539.exe44e041dc2e445fcd33cc89b8453d0539.exe44e041dc2e445fcd33cc89b8453d0539.exe

pid	process
3736	44e041dc2e445fcd33cc89b8453d0539.exe
3736	44e041dc2e445fcd33cc89b8453d0539.exe
3736	44e041dc2e445fcd33cc89b8453d0539.exe
3736	44e041dc2e445fcd33cc89b8453d0539.exe
3736	44e041dc2e445fcd33cc89b8453d0539.exe
4232	44e041dc2e445fcd33cc89b8453d0539.exe
4808	44e041dc2e445fcd33cc89b8453d0539.exe
4232	44e041dc2e445fcd33cc89b8453d0539.exe
4232	44e041dc2e445fcd33cc89b8453d0539.exe
4232	44e041dc2e445fcd33cc89b8453d0539.exe
4812	44e041dc2e445fcd33cc89b8453d0539.exe
4232	44e041dc2e445fcd33cc89b8453d0539.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 12 IoCs

Processes:

44e041dc2e445fcd33cc89b8453d0539.exe44e041dc2e445fcd33cc89b8453d0539.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\ms-settings	44e041dc2e445fcd33cc89b8453d0539.exe
Key created	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\ms-settings\shell	44e041dc2e445fcd33cc89b8453d0539.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\ms-settings\shell\open\command\DelegateExecute	44e041dc2e445fcd33cc89b8453d0539.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\44e041dc2e445fcd33cc89b8453d0539.exe -uac 3736관"	44e041dc2e445fcd33cc89b8453d0539.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\ms-settings	44e041dc2e445fcd33cc89b8453d0539.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\ms-settings\shell	44e041dc2e445fcd33cc89b8453d0539.exe
Key created	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\ms-settings\shell\open\command	44e041dc2e445fcd33cc89b8453d0539.exe
Key created	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\ms-settings\shell\open	44e041dc2e445fcd33cc89b8453d0539.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\44e041dc2e445fcd33cc89b8453d0539.exe -wdkill"	44e041dc2e445fcd33cc89b8453d0539.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\44e041dc2e445fcd33cc89b8453d0539.exe -prs 3736관"	44e041dc2e445fcd33cc89b8453d0539.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\ms-settings\shell\open\command	44e041dc2e445fcd33cc89b8453d0539.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\ms-settings\shell\open	44e041dc2e445fcd33cc89b8453d0539.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

44e041dc2e445fcd33cc89b8453d0539.exe44e041dc2e445fcd33cc89b8453d0539.exe44e041dc2e445fcd33cc89b8453d0539.exe44e041dc2e445fcd33cc89b8453d0539.exe

description	pid	process
Token: SeShutdownPrivilege	3736	44e041dc2e445fcd33cc89b8453d0539.exe
Token: SeShutdownPrivilege	4232	44e041dc2e445fcd33cc89b8453d0539.exe
Token: SeShutdownPrivilege	4808	44e041dc2e445fcd33cc89b8453d0539.exe
Token: SeShutdownPrivilege	4812	44e041dc2e445fcd33cc89b8453d0539.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

44e041dc2e445fcd33cc89b8453d0539.exe44e041dc2e445fcd33cc89b8453d0539.exe

pid	process
3736	44e041dc2e445fcd33cc89b8453d0539.exe
3736	44e041dc2e445fcd33cc89b8453d0539.exe
4232	44e041dc2e445fcd33cc89b8453d0539.exe
4232	44e041dc2e445fcd33cc89b8453d0539.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

44e041dc2e445fcd33cc89b8453d0539.exefodhelper.exefodhelper.exefodhelper.exe

description	pid	process	target process
PID 3736 wrote to memory of 4524	3736	44e041dc2e445fcd33cc89b8453d0539.exe	fodhelper.exe
PID 3736 wrote to memory of 4524	3736	44e041dc2e445fcd33cc89b8453d0539.exe	fodhelper.exe
PID 3736 wrote to memory of 2936	3736	44e041dc2e445fcd33cc89b8453d0539.exe	fodhelper.exe
PID 3736 wrote to memory of 2936	3736	44e041dc2e445fcd33cc89b8453d0539.exe	fodhelper.exe
PID 3736 wrote to memory of 4512	3736	44e041dc2e445fcd33cc89b8453d0539.exe	fodhelper.exe
PID 3736 wrote to memory of 4512	3736	44e041dc2e445fcd33cc89b8453d0539.exe	fodhelper.exe
PID 4512 wrote to memory of 4808	4512	fodhelper.exe	44e041dc2e445fcd33cc89b8453d0539.exe
PID 4512 wrote to memory of 4808	4512	fodhelper.exe	44e041dc2e445fcd33cc89b8453d0539.exe
PID 4512 wrote to memory of 4808	4512	fodhelper.exe	44e041dc2e445fcd33cc89b8453d0539.exe
PID 4524 wrote to memory of 4232	4524	fodhelper.exe	44e041dc2e445fcd33cc89b8453d0539.exe
PID 4524 wrote to memory of 4232	4524	fodhelper.exe	44e041dc2e445fcd33cc89b8453d0539.exe
PID 4524 wrote to memory of 4232	4524	fodhelper.exe	44e041dc2e445fcd33cc89b8453d0539.exe
PID 2936 wrote to memory of 4812	2936	fodhelper.exe	44e041dc2e445fcd33cc89b8453d0539.exe
PID 2936 wrote to memory of 4812	2936	fodhelper.exe	44e041dc2e445fcd33cc89b8453d0539.exe
PID 2936 wrote to memory of 4812	2936	fodhelper.exe	44e041dc2e445fcd33cc89b8453d0539.exe

C:\Users\Admin\AppData\Local\Temp\44e041dc2e445fcd33cc89b8453d0539.exe
"C:\Users\Admin\AppData\Local\Temp\44e041dc2e445fcd33cc89b8453d0539.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736

C:\Windows\System32\fodhelper.exe
"C:\Windows\System32\fodhelper.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2936

C:\Users\Admin\AppData\Local\Temp\44e041dc2e445fcd33cc89b8453d0539.exe
"C:\Users\Admin\AppData\Local\Temp\44e041dc2e445fcd33cc89b8453d0539.exe" -uac 3736
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Windows\System32\fodhelper.exe
"C:\Windows\System32\fodhelper.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4524

C:\Users\Admin\AppData\Local\Temp\44e041dc2e445fcd33cc89b8453d0539.exe
"C:\Users\Admin\AppData\Local\Temp\44e041dc2e445fcd33cc89b8453d0539.exe" -uac 3736
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4232

C:\Windows\System32\fodhelper.exe
"C:\Windows\System32\fodhelper.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4512

C:\Users\Admin\AppData\Local\Temp\44e041dc2e445fcd33cc89b8453d0539.exe
"C:\Users\Admin\AppData\Local\Temp\44e041dc2e445fcd33cc89b8453d0539.exe" -uac 3736
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2936-135-0x0000000000000000-mapping.dmp

Download
memory/3736-140-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3736-131-0x00000000751E0000-0x0000000075219000-memory.dmp

Filesize
228KB

Download
memory/3736-132-0x0000000075560000-0x0000000075599000-memory.dmp

Filesize
228KB

Download
memory/3736-133-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3736-130-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3736-141-0x00000000751E0000-0x0000000075219000-memory.dmp

Filesize
228KB

Download
memory/4232-145-0x0000000075280000-0x00000000752B9000-memory.dmp

Filesize
228KB

Download
memory/4232-138-0x0000000000000000-mapping.dmp

Download
memory/4232-150-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4232-149-0x0000000075210000-0x0000000075249000-memory.dmp

Filesize
228KB

Download
memory/4232-143-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4512-136-0x0000000000000000-mapping.dmp

Download
memory/4524-134-0x0000000000000000-mapping.dmp

Download
memory/4808-144-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4808-146-0x0000000075280000-0x00000000752B9000-memory.dmp

Filesize
228KB

Download
memory/4808-147-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4808-137-0x0000000000000000-mapping.dmp

Download
memory/4812-142-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4812-148-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4812-139-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads