bitrat | 3f558725f854c9668efb18a9b88e4b24798170953fd74607f8678afa3982bffe

Analysis

max time kernel
151s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-10-2022 05:56

Target

a1d9736DPC.exe
Size

1.7MB
MD5

7e9811681ab52fd4e2ac4441f6a3cc20
SHA1

201d2cf050703a3c030d996c01812ae7804f8008
SHA256

3f558725f854c9668efb18a9b88e4b24798170953fd74607f8678afa3982bffe
SHA512

a9aa1f53a006fc92934da39b3667b36da1a8803244b3e30ef29085408722f07a697c15286d33b00f1f261d5cdf84ade7f2b9376f8638d52205dc60b0d06a0f6b
SSDEEP

49152:1BteuU1W+Up1gB9/hsG5jtSXWOjhGBRjIugWeRpTC:QuU1F2gH/mjtGBxJgWWTC

Score

10^/10

bitrat trojan upx

Family

bitrat

Version

1.38

192.3.76.153:5200

Attributes

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1364-56-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1364-58-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1364-59-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1364-60-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1364-62-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1364-65-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

notepad.exe

pid process

1364 notepad.exe
1364 notepad.exe
1364 notepad.exe
1364 notepad.exe
1364 notepad.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

a1d9736DPC.exe

description pid process target process

PID 1972 set thread context of 1364 1972 a1d9736DPC.exe notepad.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

notepad.exe

description pid process

Token: SeDebugPrivilege 1364 notepad.exe
Token: SeShutdownPrivilege 1364 notepad.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

notepad.exe

pid process

1364 notepad.exe
1364 notepad.exe

description	pid	process	target process
PID 1972 set thread context of 1364	1972	a1d9736DPC.exe	notepad.exe

description	pid	process
Token: SeDebugPrivilege	1364	notepad.exe
Token: SeShutdownPrivilege	1364	notepad.exe

pid	process
1364	notepad.exe
1364	notepad.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a1d9736DPC.exe

description	pid	process	target process
PID 1972 wrote to memory of 1364	1972	a1d9736DPC.exe	notepad.exe
PID 1972 wrote to memory of 1364	1972	a1d9736DPC.exe	notepad.exe
PID 1972 wrote to memory of 1364	1972	a1d9736DPC.exe	notepad.exe
PID 1972 wrote to memory of 1364	1972	a1d9736DPC.exe	notepad.exe
PID 1972 wrote to memory of 1364	1972	a1d9736DPC.exe	notepad.exe
PID 1972 wrote to memory of 1364	1972	a1d9736DPC.exe	notepad.exe
PID 1972 wrote to memory of 1364	1972	a1d9736DPC.exe	notepad.exe
PID 1972 wrote to memory of 1364	1972	a1d9736DPC.exe	notepad.exe

memory/1364-60-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1364-62-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1364-56-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1364-57-0x00000000007E2730-mapping.dmp

Download
memory/1364-58-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1364-59-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1364-67-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/1364-66-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/1364-64-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/1364-63-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/1364-61-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1364-65-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1972-54-0x0000000000D30000-0x0000000000EE4000-memory.dmp

Filesize
1.7MB

Download
memory/1972-55-0x000000001B350000-0x000000001B4FA000-memory.dmp

Filesize
1.7MB

Download