bitrat | 99c95ed1a1192492b4f73a54381f02e927ce26dcae0489b63be67401e015cc78

General

Target

Policy-Document.exe
Size

300.0MB
MD5

8a6c934a28abfd03fa9f259a7ced202d
SHA1

1d623700b282fcb94b691c8e6d5473fdac5e3f3e
SHA256

47c38d37274d645b491b7cff7b298049054c18b3ad95064a3b241163a4198106
SHA512

3a51c39eeafbac5f40468118f569dbdc66d76b2fe45376e1d9a0a26c7003a98315457bb06bb68228a75d54d3e18a6c55404d4c3032e1230b32773c61ba5efc3a

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

yakbitpeople.duckdns.org:9175

Attributes

communication_password
827ccb0eea8a706c4c34a16891f84e7b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Executes dropped EXE 1 IoCs

Processes:

msdtc.exe

pid process

3028 msdtc.exe

pid	process
3028	msdtc.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral4/memory/552-134-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral4/memory/552-138-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral4/memory/552-140-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral4/memory/552-136-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral4/memory/552-142-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral4/memory/552-145-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

RegAsm.exe

pid process

552 RegAsm.exe
552 RegAsm.exe
552 RegAsm.exe
552 RegAsm.exe
552 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Policy-Document.exe

description pid process target process

PID 4332 set thread context of 552 4332 Policy-Document.exe RegAsm.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

368 schtasks.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Policy-Document.exeRegAsm.exemsdtc.exe

description pid process

Token: SeDebugPrivilege 4332 Policy-Document.exe
Token: SeShutdownPrivilege 552 RegAsm.exe
Token: SeDebugPrivilege 3028 msdtc.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

RegAsm.exe

pid process

552 RegAsm.exe
552 RegAsm.exe

pid	process
552	RegAsm.exe
552	RegAsm.exe
552	RegAsm.exe
552	RegAsm.exe
552	RegAsm.exe

description	pid	process	target process
PID 4332 set thread context of 552	4332	Policy-Document.exe	RegAsm.exe

pid	process
368	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	4332	Policy-Document.exe
Token: SeShutdownPrivilege	552	RegAsm.exe
Token: SeDebugPrivilege	3028	msdtc.exe

pid	process
552	RegAsm.exe
552	RegAsm.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

Policy-Document.execmd.exe

description	pid	process	target process
PID 4332 wrote to memory of 552	4332	Policy-Document.exe	RegAsm.exe
PID 4332 wrote to memory of 552	4332	Policy-Document.exe	RegAsm.exe
PID 4332 wrote to memory of 552	4332	Policy-Document.exe	RegAsm.exe
PID 4332 wrote to memory of 552	4332	Policy-Document.exe	RegAsm.exe
PID 4332 wrote to memory of 552	4332	Policy-Document.exe	RegAsm.exe
PID 4332 wrote to memory of 552	4332	Policy-Document.exe	RegAsm.exe
PID 4332 wrote to memory of 552	4332	Policy-Document.exe	RegAsm.exe
PID 4332 wrote to memory of 3264	4332	Policy-Document.exe	cmd.exe
PID 4332 wrote to memory of 3264	4332	Policy-Document.exe	cmd.exe
PID 4332 wrote to memory of 3264	4332	Policy-Document.exe	cmd.exe
PID 4332 wrote to memory of 212	4332	Policy-Document.exe	cmd.exe
PID 4332 wrote to memory of 212	4332	Policy-Document.exe	cmd.exe
PID 4332 wrote to memory of 212	4332	Policy-Document.exe	cmd.exe
PID 4332 wrote to memory of 3180	4332	Policy-Document.exe	cmd.exe
PID 4332 wrote to memory of 3180	4332	Policy-Document.exe	cmd.exe
PID 4332 wrote to memory of 3180	4332	Policy-Document.exe	cmd.exe
PID 212 wrote to memory of 368	212	cmd.exe	schtasks.exe
PID 212 wrote to memory of 368	212	cmd.exe	schtasks.exe
PID 212 wrote to memory of 368	212	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Policy-Document.exe
"C:\Users\Admin\AppData\Local\Temp\Policy-Document.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:552

C:\Windows\SysWOW64\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\msdtc"
2⤵
PID:3264

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msdtc\msdtc.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msdtc\msdtc.exe'" /f
3⤵
- Creates scheduled task(s)
PID:368

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\Policy-Document.exe" "C:\Users\Admin\AppData\Roaming\msdtc\msdtc.exe"
2⤵
PID:3180

C:\Users\Admin\AppData\Roaming\msdtc\msdtc.exe
C:\Users\Admin\AppData\Roaming\msdtc\msdtc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\msdtc\msdtc.exe
Filesize
130.9MB

MD5
6d1b8343359401912e9995e56a7426aa

SHA1
50bf44f97c3b8c2bc8e0960a2a134eba52e7b90e

SHA256
80fa97f700fe7d4bf272c715b821e18451dfe78235020b5a403d35fb4a92e69f

SHA512
db592bc68a852b38a2122ac8692951da489f5682f39f3c3417fe022530a526f08499ae9a4cc472255e9a196e36cf9c890c8ec777d96ad69028bfe4b73a35e830

Download Submit
C:\Users\Admin\AppData\Roaming\msdtc\msdtc.exe
Filesize
130.6MB

MD5
18fded0253f28d193436deba6356e37c

SHA1
a03bca241bd5912b9cc36e56639ca8546e73dd1f

SHA256
e278620e320f409289fb08598d6d6fd53f744dee2977f3b15c62d3196209f7db

SHA512
407f919fc8de73713b94b81f69b8f5d7b38915b731bf61eef6208fcf170dc8145869de1d0bfc4519845ed59d298acbfa13243bd0524c37705fa8509b3a9aa064

Download Submit
memory/212-137-0x0000000000000000-mapping.dmp

Download
memory/368-141-0x0000000000000000-mapping.dmp

Download
memory/552-136-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/552-146-0x0000000075630000-0x0000000075669000-memory.dmp

Filesize
228KB

Download
memory/552-140-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/552-133-0x0000000000000000-mapping.dmp

Download
memory/552-134-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/552-138-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/552-142-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/552-143-0x00000000752B0000-0x00000000752E9000-memory.dmp

Filesize
228KB

Download
memory/552-144-0x0000000075630000-0x0000000075669000-memory.dmp

Filesize
228KB

Download
memory/552-145-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3028-149-0x0000000000E10000-0x0000000000FF0000-memory.dmp

Filesize
1.9MB

Download
memory/3180-139-0x0000000000000000-mapping.dmp

Download
memory/3264-135-0x0000000000000000-mapping.dmp

Download
memory/4332-132-0x0000000000030000-0x0000000000210000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads