bitrat | 3f558725f854c9668efb18a9b88e4b24798170953fd74607f8678afa3982bffe

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 05:56

Target

a1d9736DPC.exe
Size

1.7MB
MD5

7e9811681ab52fd4e2ac4441f6a3cc20
SHA1

201d2cf050703a3c030d996c01812ae7804f8008
SHA256

3f558725f854c9668efb18a9b88e4b24798170953fd74607f8678afa3982bffe
SHA512

a9aa1f53a006fc92934da39b3667b36da1a8803244b3e30ef29085408722f07a697c15286d33b00f1f261d5cdf84ade7f2b9376f8638d52205dc60b0d06a0f6b
SSDEEP

49152:1BteuU1W+Up1gB9/hsG5jtSXWOjhGBRjIugWeRpTC:QuU1F2gH/mjtGBxJgWWTC

Score

10^/10

bitrat trojan upx

Family

bitrat

Version

1.38

192.3.76.153:5200

Attributes

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3168-135-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3168-138-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3168-139-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3168-140-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3168-141-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3168-144-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

notepad.exe

pid process

3168 notepad.exe
3168 notepad.exe
3168 notepad.exe
3168 notepad.exe
3168 notepad.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

a1d9736DPC.exe

description pid process target process

PID 3328 set thread context of 3168 3328 a1d9736DPC.exe notepad.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a1d9736DPC.exe

pid process

3328 a1d9736DPC.exe
3328 a1d9736DPC.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a1d9736DPC.exenotepad.exe

description pid process

Token: SeDebugPrivilege 3328 a1d9736DPC.exe
Token: SeShutdownPrivilege 3168 notepad.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

notepad.exe

pid process

3168 notepad.exe
3168 notepad.exe

description	pid	process	target process
PID 3328 set thread context of 3168	3328	a1d9736DPC.exe	notepad.exe

pid	process
3328	a1d9736DPC.exe
3328	a1d9736DPC.exe

description	pid	process
Token: SeDebugPrivilege	3328	a1d9736DPC.exe
Token: SeShutdownPrivilege	3168	notepad.exe

pid	process
3168	notepad.exe
3168	notepad.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a1d9736DPC.exe

description	pid	process	target process
PID 3328 wrote to memory of 924	3328	a1d9736DPC.exe	notepad.exe
PID 3328 wrote to memory of 924	3328	a1d9736DPC.exe	notepad.exe
PID 3328 wrote to memory of 924	3328	a1d9736DPC.exe	notepad.exe
PID 3328 wrote to memory of 3168	3328	a1d9736DPC.exe	notepad.exe
PID 3328 wrote to memory of 3168	3328	a1d9736DPC.exe	notepad.exe
PID 3328 wrote to memory of 3168	3328	a1d9736DPC.exe	notepad.exe
PID 3328 wrote to memory of 3168	3328	a1d9736DPC.exe	notepad.exe
PID 3328 wrote to memory of 3168	3328	a1d9736DPC.exe	notepad.exe
PID 3328 wrote to memory of 3168	3328	a1d9736DPC.exe	notepad.exe
PID 3328 wrote to memory of 3168	3328	a1d9736DPC.exe	notepad.exe

memory/3168-138-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3168-140-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3168-146-0x0000000074260000-0x0000000074299000-memory.dmp

Filesize
228KB

Download
memory/3168-135-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3168-136-0x00000000007E2730-mapping.dmp

Download
memory/3168-145-0x00000000745A0000-0x00000000745D9000-memory.dmp

Filesize
228KB

Download
memory/3168-144-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3168-139-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3168-143-0x0000000074260000-0x0000000074299000-memory.dmp

Filesize
228KB

Download
memory/3168-141-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3168-142-0x00000000745A0000-0x00000000745D9000-memory.dmp

Filesize
228KB

Download
memory/3328-132-0x000001C7341E0000-0x000001C734394000-memory.dmp

Filesize
1.7MB

Download
memory/3328-133-0x00007FF8D0450000-0x00007FF8D0F11000-memory.dmp

Filesize
10.8MB

Download
memory/3328-137-0x00007FF8D0450000-0x00007FF8D0F11000-memory.dmp

Filesize
10.8MB

Download
memory/3328-134-0x00007FF8D0450000-0x00007FF8D0F11000-memory.dmp

Filesize
10.8MB

Download