bitrat | 08cfe144396f7fc7aaf3a47e86826d439502e4e80e6a9043bcb026ae2f1e845a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2023 07:06

Target

INVOICEXls223.exe
Size

6.4MB
MD5

29f24671b31ec4849ec02229d8bea0b2
SHA1

bba17ef1c4c0b02c6f4fc076a6035e86430c21e6
SHA256

08cfe144396f7fc7aaf3a47e86826d439502e4e80e6a9043bcb026ae2f1e845a
SHA512

da78442a44a912e871a654b6f02c5331e5ed7296c712d14ff7ec8c4e360dd92b33ebcf8d2975c3576093318d70d1f7c59f6047a1eedacb7f246758c19fb7527d
SSDEEP

49152:RI+dckN2zRMPlPot7kTg0AMv54vzp82GjPKa6:RI+dc

Score

10^/10

bitrat trojan upx

Family

bitrat

Version

1.38

celesperial.ddns.net:5200

Attributes

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3260-135-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3260-137-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3260-138-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3260-136-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3260-141-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

RegSvcs.exe

pid process

3260 RegSvcs.exe
3260 RegSvcs.exe
3260 RegSvcs.exe
3260 RegSvcs.exe
3260 RegSvcs.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

INVOICEXls223.exe

description pid process target process

PID 2500 set thread context of 3260 2500 INVOICEXls223.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

INVOICEXls223.exe

pid process

2500 INVOICEXls223.exe
2500 INVOICEXls223.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

INVOICEXls223.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 2500 INVOICEXls223.exe
Token: SeShutdownPrivilege 3260 RegSvcs.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

RegSvcs.exe

pid process

3260 RegSvcs.exe
3260 RegSvcs.exe

description	pid	process	target process
PID 2500 set thread context of 3260	2500	INVOICEXls223.exe	RegSvcs.exe

pid	process
2500	INVOICEXls223.exe
2500	INVOICEXls223.exe

description	pid	process
Token: SeDebugPrivilege	2500	INVOICEXls223.exe
Token: SeShutdownPrivilege	3260	RegSvcs.exe

pid	process
3260	RegSvcs.exe
3260	RegSvcs.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

INVOICEXls223.exe

description	pid	process	target process
PID 2500 wrote to memory of 748	2500	INVOICEXls223.exe	RegSvcs.exe
PID 2500 wrote to memory of 748	2500	INVOICEXls223.exe	RegSvcs.exe
PID 2500 wrote to memory of 748	2500	INVOICEXls223.exe	RegSvcs.exe
PID 2500 wrote to memory of 3260	2500	INVOICEXls223.exe	RegSvcs.exe
PID 2500 wrote to memory of 3260	2500	INVOICEXls223.exe	RegSvcs.exe
PID 2500 wrote to memory of 3260	2500	INVOICEXls223.exe	RegSvcs.exe
PID 2500 wrote to memory of 3260	2500	INVOICEXls223.exe	RegSvcs.exe
PID 2500 wrote to memory of 3260	2500	INVOICEXls223.exe	RegSvcs.exe
PID 2500 wrote to memory of 3260	2500	INVOICEXls223.exe	RegSvcs.exe
PID 2500 wrote to memory of 3260	2500	INVOICEXls223.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"
2⤵
PID:748

memory/748-133-0x0000000000000000-mapping.dmp

Download
memory/2500-132-0x0000000000180000-0x00000000007E8000-memory.dmp

Filesize
6.4MB

Download
memory/3260-136-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3260-135-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3260-137-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3260-138-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3260-134-0x0000000000000000-mapping.dmp

Download
memory/3260-139-0x0000000074F50000-0x0000000074F89000-memory.dmp

Filesize
228KB

Download
memory/3260-140-0x00000000752D0000-0x0000000075309000-memory.dmp

Filesize
228KB

Download
memory/3260-141-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3260-142-0x00000000752D0000-0x0000000075309000-memory.dmp

Filesize
228KB

Download
memory/3260-143-0x0000000074F50000-0x0000000074F89000-memory.dmp

Filesize
228KB

Download
memory/3260-144-0x00000000752D0000-0x0000000075309000-memory.dmp

Filesize
228KB

Download
memory/3260-145-0x00000000752D0000-0x0000000075309000-memory.dmp

Filesize
228KB

Download