bitrat | 91bc7e071b37cdf14220e978ad547daf9015e3a7ca24d220c2255d114cd7da1b | Triage

Analysis

max time kernel
146s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-08-2022 18:51

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

1.4MB
MD5

bf8f6b36e82b6d885966498c42654d27
SHA1

116e39cbb69edf8e2ca85dbc31cd962bcdad1f30
SHA256

91bc7e071b37cdf14220e978ad547daf9015e3a7ca24d220c2255d114cd7da1b
SHA512

14530de7f5fea67eb9e497cda65a8818b6853dc0dd34509fe03a95b5bcc7622bbd4a517223f25d340a50e1b5aa15605b69f99db38dcc3fac04c1c5dd29a980e1

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

eichelberger.duckdns.org:7744

Attributes

communication_password
2eb6e59fac395f7cb5a7b52ea31fa9f2
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1056-55-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1056-56-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

tmp.exe

pid process

1056 tmp.exe
1056 tmp.exe
1056 tmp.exe
1056 tmp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 1056 tmp.exe
Token: SeShutdownPrivilege 1056 tmp.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

tmp.exe

pid process

1056 tmp.exe
1056 tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-54-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1056-55-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1056-56-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download