bitrat | 6a8831628879277d2a2dc0545d9ad93e81d77dd06aa0a5ecd6ad21e6906890e2

General

Target

a373d064cabacfd615563b9f094ae79e051f8f481ebaade3acb662863662f359.exe
Size

3.8MB
MD5

77a3f13034cd5f7cbaf5ec1dd930d97b
SHA1

5b6bf670f93411031b05d8bb6870bbd3eaae52a9
SHA256

a373d064cabacfd615563b9f094ae79e051f8f481ebaade3acb662863662f359
SHA512

ffdd0ae1bba55a42e7137b03b92d66e25495f579343b9b29ab3348c6acc3d2aca93bbd254161054350f185f0fcc1c219c04ed79ad431a580f78702305e7ab3d7
SSDEEP

98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/ZmlwXVZ4FB:5+R/eZADUXR

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

policy-generating.at.ply.gg:48719

Attributes

communication_password
81dc9bdb52d04dc20036dbd8313ed055
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Drops file in System32 directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{1E1566A8-B98B-49A8-B24A-75C06118538E}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D34D6774-8C8B-4EC2-87BE-C6AEDCD68CE7}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

a373d064cabacfd615563b9f094ae79e051f8f481ebaade3acb662863662f359.exe

pid	process
2604	a373d064cabacfd615563b9f094ae79e051f8f481ebaade3acb662863662f359.exe
2604	a373d064cabacfd615563b9f094ae79e051f8f481ebaade3acb662863662f359.exe
2604	a373d064cabacfd615563b9f094ae79e051f8f481ebaade3acb662863662f359.exe
2604	a373d064cabacfd615563b9f094ae79e051f8f481ebaade3acb662863662f359.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a373d064cabacfd615563b9f094ae79e051f8f481ebaade3acb662863662f359.exe

description pid process

Token: SeShutdownPrivilege 2604 a373d064cabacfd615563b9f094ae79e051f8f481ebaade3acb662863662f359.exe

description	pid	process
Token: SeShutdownPrivilege	2604	a373d064cabacfd615563b9f094ae79e051f8f481ebaade3acb662863662f359.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a373d064cabacfd615563b9f094ae79e051f8f481ebaade3acb662863662f359.exe

pid	process
2604	a373d064cabacfd615563b9f094ae79e051f8f481ebaade3acb662863662f359.exe
2604	a373d064cabacfd615563b9f094ae79e051f8f481ebaade3acb662863662f359.exe

C:\Users\Admin\AppData\Local\Temp\a373d064cabacfd615563b9f094ae79e051f8f481ebaade3acb662863662f359.exe
"C:\Users\Admin\AppData\Local\Temp\a373d064cabacfd615563b9f094ae79e051f8f481ebaade3acb662863662f359.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2604-132-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2604-133-0x0000000074FA0000-0x0000000074FD9000-memory.dmp

Filesize
228KB

Download
memory/2604-134-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-135-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-136-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-137-0x0000000074FA0000-0x0000000074FD9000-memory.dmp

Filesize
228KB

Download
memory/2604-138-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-139-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-140-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-141-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-142-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-143-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-144-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-145-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-146-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-147-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-148-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-149-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-150-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-151-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-152-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-153-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-154-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-155-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-156-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-157-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-158-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-159-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-160-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-161-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-162-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-163-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download
memory/2604-164-0x0000000075320000-0x0000000075359000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads