bitrat | 91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb

General

Target

91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
Size

230KB
MD5

c8461fb52f97b3a3186954e5fb14752d
SHA1

3838ad7fddfb3a013d30afd515c80e9ac37cb7c4
SHA256

91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb
SHA512

0c01fe3f2a52b593fa634ae8fc7cbec716f0fa497f8fa09e0e3ed0506f79b20f8b97fead4eeb0edd3f35101fbc70e53128d7f0130bed18315b76dea6fcce3a4a

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

eichelberger.duckdns.org:7744

Attributes

communication_password
2eb6e59fac395f7cb5a7b52ea31fa9f2
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Downloads MZ/PE file

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3892-135-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/3892-136-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/3892-137-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/3892-138-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/3892-139-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/3892-142-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe

pid	process
3892	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
3892	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
3892	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
3892	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
3892	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe

description	pid	process	target process
PID 4504 set thread context of 3892	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe

description pid process

Token: SeShutdownPrivilege 3892 91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe

description	pid	process
Token: SeShutdownPrivilege	3892	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe

pid	process
3892	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
3892	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe

C:\Users\Admin\AppData\Local\Temp\91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
"C:\Users\Admin\AppData\Local\Temp\91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4504

C:\Users\Admin\AppData\Local\Temp\91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
"C:\Users\Admin\AppData\Local\Temp\91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe"
2⤵
PID:3496

C:\Users\Admin\AppData\Local\Temp\91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
"C:\Users\Admin\AppData\Local\Temp\91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe"
2⤵
PID:3492

C:\Users\Admin\AppData\Local\Temp\91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
"C:\Users\Admin\AppData\Local\Temp\91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe"
2⤵
PID:3696

C:\Users\Admin\AppData\Local\Temp\91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
"C:\Users\Admin\AppData\Local\Temp\91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe"
2⤵
PID:1336

C:\Users\Admin\AppData\Local\Temp\91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
"C:\Users\Admin\AppData\Local\Temp\91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1336-133-0x0000000000000000-mapping.dmp

Download
memory/3492-131-0x0000000000000000-mapping.dmp

Download
memory/3496-130-0x0000000000000000-mapping.dmp

Download
memory/3696-132-0x0000000000000000-mapping.dmp

Download
memory/3892-136-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3892-135-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3892-134-0x0000000000000000-mapping.dmp

Download
memory/3892-137-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3892-138-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3892-139-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3892-140-0x0000000075000000-0x0000000075039000-memory.dmp

Filesize
228KB

Download
memory/3892-141-0x0000000075380000-0x00000000753B9000-memory.dmp

Filesize
228KB

Download
memory/3892-142-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3892-143-0x0000000075000000-0x0000000075039000-memory.dmp

Filesize
228KB

Download
memory/3892-144-0x0000000075380000-0x00000000753B9000-memory.dmp

Filesize
228KB

Download

description	pid	process	target process
PID 4504 wrote to memory of 3496	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3496	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3496	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3492	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3492	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3492	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3696	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3696	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3696	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 1336	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 1336	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 1336	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3892	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3892	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3892	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3892	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3892	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3892	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3892	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe
PID 4504 wrote to memory of 3892	4504	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe	91abc0cabd554c1b0dce52d6094895dd43c6d7251ce109fe51a85d433c2f36eb.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads