bitrat | d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245

General

Target

d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
Size

2.8MB
MD5

ed1ececd2601553016326499250995a5
SHA1

790ee4b36607be69497dc140128fef7e168041db
SHA256

d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245
SHA512

1e3d86795f1fbcdc5dc730ab83764a7af294a97421901c53966e8b4224e3654c36fe59d7260108702edcef60b4801c0479a1e09d3272a8688ad3798fee21f514
SSDEEP

49152:WM60nwd3bfu7Kd/Qdt1kynoAYfjCAy5+245hDQESYp6O13c1teWvs1WxN:WWw47Ckt1kyoAweAy5+2uh7Jl3kq

Score

10^/10

bitrat persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.34

C2

connection.accesscam.org:1234

Attributes

communication_password
725fbb843778ec4d2362b23f11e5d956
install_dir
Audios
install_file
SmartAudio.exe
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SmartAudio = "C:\\Users\\Admin\\AppData\\Local\\Audios\\SmartAudio.exe"	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

pid	process
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

description	pid	process	target process
PID 4248 set thread context of 2352	4248	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

pid process

4248 d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

Suspicious behavior: RenamesItself 27 IoCs

Processes:

d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

pid	process
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

description pid process

Token: SeShutdownPrivilege 2352 d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

description	pid	process
Token: SeShutdownPrivilege	2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exed2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

pid	process
4248	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
2352	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

description	pid	process	target process
PID 4248 wrote to memory of 2352	4248	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
PID 4248 wrote to memory of 2352	4248	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
PID 4248 wrote to memory of 2352	4248	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
PID 4248 wrote to memory of 2352	4248	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe	d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe

C:\Users\Admin\AppData\Local\Temp\d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
"C:\Users\Admin\AppData\Local\Temp\d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248

C:\Users\Admin\AppData\Local\Temp\d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe
"C:\Users\Admin\AppData\Local\Temp\d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245.exe"
2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-140-0x0000000074AB0000-0x0000000074AE9000-memory.dmp

Filesize
228KB

Download
memory/2352-142-0x0000000074AB0000-0x0000000074AE9000-memory.dmp

Filesize
228KB

Download
memory/2352-147-0x0000000074AB0000-0x0000000074AE9000-memory.dmp

Filesize
228KB

Download
memory/2352-137-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2352-138-0x0000000074DF0000-0x0000000074E29000-memory.dmp

Filesize
228KB

Download
memory/2352-139-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2352-135-0x0000000000000000-mapping.dmp

Download
memory/2352-146-0x0000000074AB0000-0x0000000074AE9000-memory.dmp

Filesize
228KB

Download
memory/2352-144-0x0000000074AB0000-0x0000000074AE9000-memory.dmp

Filesize
228KB

Download
memory/2352-143-0x0000000074AB0000-0x0000000074AE9000-memory.dmp

Filesize
228KB

Download
memory/2352-141-0x0000000074AB0000-0x0000000074AE9000-memory.dmp

Filesize
228KB

Download
memory/2352-145-0x0000000074AB0000-0x0000000074AE9000-memory.dmp

Filesize
228KB

Download
memory/4248-134-0x0000000000BA0000-0x0000000000BA8000-memory.dmp

Filesize
32KB

Download
memory/4248-136-0x0000000000BA0000-0x0000000000BA8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads