bitrat | bec7f761c529f547e16cc2867fd6bf96bd0e6a6740d70da8c57789fdbb71f9b3 | Triage

Analysis

max time kernel
148s
max time network
142s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-08-2022 08:32

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

1.4MB
MD5

21f894391eaac76010275132312ac5c8
SHA1

c2f20f6d6a8881ddd0ac04f9d87a11d2e9a817f3
SHA256

bec7f761c529f547e16cc2867fd6bf96bd0e6a6740d70da8c57789fdbb71f9b3
SHA512

7cdd5fdfb40027a6c6fd5a6dbb0621a29dd183d318be6d203bca51b699c3e26219a4910cfc1ceaaa2183103577eb86e1fb84426e6b8a6f07127abb72bf36244e
SSDEEP

24576:bndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkz7In5x4ZY:TXDFBU2iIBb0xY/6sUYY7n5b

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

trotox.duckdns.org:55441

Attributes

communication_password
4b49ee1f55b1900518dfb23fd2d7c702
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/112-55-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/112-56-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

tmp.exe

pid process

112 tmp.exe
112 tmp.exe
112 tmp.exe
112 tmp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 112 tmp.exe
Token: SeShutdownPrivilege 112 tmp.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

tmp.exe

pid process

112 tmp.exe
112 tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/112-55-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/112-56-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download