bitrat | 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad | Triage

Analysis

max time kernel
144s
max time network
138s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
02-08-2022 20:03

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

1.4MB
MD5

44e041dc2e445fcd33cc89b8453d0539
SHA1

99faf5ac243f30d7041e7018f41490023b552f60
SHA256

707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad
SHA512

893019fd4b969250464a551bdeb0fc050da5bc82f1680b5ef116e8cc43b2e0b4088ec351f91d0d4b379ffd61fb32a02a34ea11fb94ca35fc4ed064dda021bf18

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

trotox.duckdns.org:55441

Attributes

communication_password
4b49ee1f55b1900518dfb23fd2d7c702
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/892-55-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/892-56-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

tmp.exe

pid process

892 tmp.exe
892 tmp.exe
892 tmp.exe
892 tmp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 892 tmp.exe
Token: SeShutdownPrivilege 892 tmp.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

tmp.exe

pid process

892 tmp.exe
892 tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/892-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/892-55-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/892-56-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download