bitrat | 3f558725f854c9668efb18a9b88e4b24798170953fd74607f8678afa3982bffe

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 05:56

Target

a1d9736DPC.exe
Size

1.7MB
MD5

7e9811681ab52fd4e2ac4441f6a3cc20
SHA1

201d2cf050703a3c030d996c01812ae7804f8008
SHA256

3f558725f854c9668efb18a9b88e4b24798170953fd74607f8678afa3982bffe
SHA512

a9aa1f53a006fc92934da39b3667b36da1a8803244b3e30ef29085408722f07a697c15286d33b00f1f261d5cdf84ade7f2b9376f8638d52205dc60b0d06a0f6b
SSDEEP

49152:1BteuU1W+Up1gB9/hsG5jtSXWOjhGBRjIugWeRpTC:QuU1F2gH/mjtGBxJgWWTC

Score

10^/10

bitrat trojan upx

Family

bitrat

Version

1.38

192.3.76.153:5200

Attributes

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4320-135-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4320-138-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4320-139-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4320-140-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4320-141-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4320-144-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

notepad.exe

pid process

4320 notepad.exe
4320 notepad.exe
4320 notepad.exe
4320 notepad.exe
4320 notepad.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

a1d9736DPC.exe

description pid process target process

PID 4916 set thread context of 4320 4916 a1d9736DPC.exe notepad.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

notepad.exe

description pid process

Token: SeShutdownPrivilege 4320 notepad.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

notepad.exe

pid process

4320 notepad.exe
4320 notepad.exe

description	pid	process	target process
PID 4916 set thread context of 4320	4916	a1d9736DPC.exe	notepad.exe

description	pid	process
Token: SeShutdownPrivilege	4320	notepad.exe

pid	process
4320	notepad.exe
4320	notepad.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

a1d9736DPC.exe

description	pid	process	target process
PID 4916 wrote to memory of 4320	4916	a1d9736DPC.exe	notepad.exe
PID 4916 wrote to memory of 4320	4916	a1d9736DPC.exe	notepad.exe
PID 4916 wrote to memory of 4320	4916	a1d9736DPC.exe	notepad.exe
PID 4916 wrote to memory of 4320	4916	a1d9736DPC.exe	notepad.exe
PID 4916 wrote to memory of 4320	4916	a1d9736DPC.exe	notepad.exe
PID 4916 wrote to memory of 4320	4916	a1d9736DPC.exe	notepad.exe
PID 4916 wrote to memory of 4320	4916	a1d9736DPC.exe	notepad.exe

memory/4320-138-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4320-140-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4320-146-0x00000000751E0000-0x0000000075219000-memory.dmp

Filesize
228KB

Download
memory/4320-135-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4320-136-0x00000000007E2730-mapping.dmp

Download
memory/4320-145-0x0000000074E20000-0x0000000074E59000-memory.dmp

Filesize
228KB

Download
memory/4320-144-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4320-139-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4320-143-0x00000000751E0000-0x0000000075219000-memory.dmp

Filesize
228KB

Download
memory/4320-141-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4320-142-0x0000000074E20000-0x0000000074E59000-memory.dmp

Filesize
228KB

Download
memory/4916-132-0x00000137BA420000-0x00000137BA5D4000-memory.dmp

Filesize
1.7MB

Download
memory/4916-133-0x00007FFEE8B60000-0x00007FFEE9621000-memory.dmp

Filesize
10.8MB

Download
memory/4916-137-0x00007FFEE8B60000-0x00007FFEE9621000-memory.dmp

Filesize
10.8MB

Download
memory/4916-134-0x00007FFEE8B60000-0x00007FFEE9621000-memory.dmp

Filesize
10.8MB

Download