bitrat | bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744

General

Target

bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe
Size

1.5MB
MD5

f414cb14362149432ee7627a94ca5633
SHA1

d62c38f089255d975720090b1d59ba7c6742e0d0
SHA256

bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744
SHA512

b736c1870a4fddeb7713a4b6e083021bbaad7df533759d1fead14a8af4f6b17e07b7a735e918958f4e237bf38b21d09d452ccf1d13417f0aa12a0b37519f5a10
SSDEEP

49152:tbQjO87uv8dZXxrWpSzTEbwcS8lvC0MwmwCarNY05BKLwAqWJL:lQjOid0Ew8cSuviwCarNY05BKLwAqWJL

Score

10^/10

bitrat persistence trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.34

C2

185.244.30.105:6660

Attributes

communication_password
0d1dbf716d5d1832c99e43071c56e305
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Core1 .NET packer 1 IoCs

Detects packer/loader used by .NET malware.

Processes:

resource	yara_rule
behavioral1/memory/1728-56-0x000000001B8E0000-0x000000001BA5E000-memory.dmp	Core1

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1728-58-0x000000001C380000-0x000000001C763000-memory.dmp	upx
behavioral1/memory/368-60-0x0000000000400000-0x00000000007E3000-memory.dmp	upx
behavioral1/memory/368-62-0x0000000000400000-0x00000000007E3000-memory.dmp	upx
behavioral1/memory/368-63-0x0000000000400000-0x00000000007E3000-memory.dmp	upx
behavioral1/memory/368-65-0x0000000000400000-0x00000000007E3000-memory.dmp	upx
behavioral1/memory/368-66-0x0000000000400000-0x00000000007E3000-memory.dmp	upx
behavioral1/memory/368-67-0x0000000000400000-0x00000000007E3000-memory.dmp	upx
behavioral1/memory/368-68-0x0000000000400000-0x00000000007E3000-memory.dmp	upx
behavioral1/memory/368-70-0x0000000000400000-0x00000000007E3000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\msword.exe = "C:\\Users\\Admin\\AppData\\Roaming\\msword.exe"	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

svchost.exe

pid process

368 svchost.exe
368 svchost.exe
368 svchost.exe
368 svchost.exe

pid	process
368	svchost.exe
368	svchost.exe
368	svchost.exe
368	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe

description	pid	process	target process
PID 1728 set thread context of 368	1728	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 368 svchost.exe
Token: SeShutdownPrivilege 368 svchost.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

svchost.exe

pid process

368 svchost.exe
368 svchost.exe

description	pid	process
Token: SeDebugPrivilege	368	svchost.exe
Token: SeShutdownPrivilege	368	svchost.exe

pid	process
368	svchost.exe
368	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe

description	pid	process	target process
PID 1728 wrote to memory of 368	1728	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe
PID 1728 wrote to memory of 368	1728	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe
PID 1728 wrote to memory of 368	1728	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe
PID 1728 wrote to memory of 368	1728	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe
PID 1728 wrote to memory of 368	1728	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe
PID 1728 wrote to memory of 368	1728	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe
PID 1728 wrote to memory of 368	1728	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe
PID 1728 wrote to memory of 368	1728	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe
"C:\Users\Admin\AppData\Local\Temp\bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWow64\svchost.exe
"C:\\Windows\\SysWow64\\svchost.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-67-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/368-60-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/368-70-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/368-69-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/368-63-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/368-59-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/368-68-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/368-62-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/368-66-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/368-64-0x00000000007E1300-mapping.dmp

Download
memory/368-65-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/1728-58-0x000000001C380000-0x000000001C763000-memory.dmp

Filesize
3.9MB

Download
memory/1728-54-0x000000013FCF0000-0x000000013FE80000-memory.dmp

Filesize
1.6MB

Download
memory/1728-55-0x000000001BDF0000-0x000000001BF6E000-memory.dmp

Filesize
1.5MB

Download
memory/1728-57-0x00000000009D0000-0x00000000009D8000-memory.dmp

Filesize
32KB

Download
memory/1728-56-0x000000001B8E0000-0x000000001BA5E000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads