bitrat | bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744

Analysis

max time kernel
266s
max time network
289s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe
Size

1.5MB
MD5

f414cb14362149432ee7627a94ca5633
SHA1

d62c38f089255d975720090b1d59ba7c6742e0d0
SHA256

bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744
SHA512

b736c1870a4fddeb7713a4b6e083021bbaad7df533759d1fead14a8af4f6b17e07b7a735e918958f4e237bf38b21d09d452ccf1d13417f0aa12a0b37519f5a10
SSDEEP

49152:tbQjO87uv8dZXxrWpSzTEbwcS8lvC0MwmwCarNY05BKLwAqWJL:lQjOid0Ew8cSuviwCarNY05BKLwAqWJL

Score

10^/10

bitrat persistence trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.34

185.244.30.105:6660

Attributes

communication_password
0d1dbf716d5d1832c99e43071c56e305
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1840-135-0x0000000000400000-0x00000000007E3000-memory.dmp	upx
behavioral2/memory/1840-137-0x0000000000400000-0x00000000007E3000-memory.dmp	upx
behavioral2/memory/1840-138-0x0000000000400000-0x00000000007E3000-memory.dmp	upx
behavioral2/memory/1840-139-0x0000000000400000-0x00000000007E3000-memory.dmp	upx
behavioral2/memory/1840-141-0x0000000000400000-0x00000000007E3000-memory.dmp	upx
behavioral2/memory/1840-142-0x0000000000400000-0x00000000007E3000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msword.exe = "C:\\Users\\Admin\\AppData\\Roaming\\msword.exe"	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

svchost.exe

pid process

1840 svchost.exe

pid	process
1840	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe

description	pid	process	target process
PID 2384 set thread context of 1840	2384	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe

description	pid	process	target process
PID 2384 wrote to memory of 1840	2384	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe
PID 2384 wrote to memory of 1840	2384	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe
PID 2384 wrote to memory of 1840	2384	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe
PID 2384 wrote to memory of 1840	2384	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe
PID 2384 wrote to memory of 1840	2384	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe
PID 2384 wrote to memory of 1840	2384	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe
PID 2384 wrote to memory of 1840	2384	bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe
"C:\Users\Admin\AppData\Local\Temp\bf12b19bb482b4d29f530a0db201cbaa4c4604743b27df4bc42ce497bb682744.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\SysWow64\svchost.exe
"C:\\Windows\\SysWow64\\svchost.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1840

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-135-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/1840-136-0x00000000007E1300-mapping.dmp

Download
memory/1840-137-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/1840-138-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/1840-139-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/1840-141-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/1840-142-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/2384-132-0x00000000005A0000-0x0000000000730000-memory.dmp

Filesize
1.6MB

Download
memory/2384-133-0x00007FF83BC30000-0x00007FF83C6F1000-memory.dmp

Filesize
10.8MB

Download
memory/2384-134-0x00007FF83BC30000-0x00007FF83C6F1000-memory.dmp

Filesize
10.8MB

Download
memory/2384-140-0x00007FF83BC30000-0x00007FF83C6F1000-memory.dmp

Filesize
10.8MB

Download