bitrat | bc0374c212e401d5f220df5657a980fc40fc210af0a7c34dd8d43556d8b2a4be

General

Target

bf35c2910d407f1cf330f465a793dc1b.exe
Size

2.1MB
MD5

bf35c2910d407f1cf330f465a793dc1b
SHA1

306324e8b2cc82f09c7b0f56cde008337b8f5205
SHA256

bc0374c212e401d5f220df5657a980fc40fc210af0a7c34dd8d43556d8b2a4be
SHA512

6fb5fa5ab36acbcf9726426b31ec843b3f8d277047e8d1d51136a91628dd3e0d2c99e6809578ab83f0cc5bb67706462b5653ce00943c7b168d010ce7faab9094
SSDEEP

49152:UrpxN1w5b1QvE4mnVA93py1abMy+mUIuEMyN5KvG8aM6TyHIzkY:Ijw5K4A93paabwtIuEMyN2G8fRY

Score

10^/10

bitrat persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

pradeepprabhu705.hopto.org:312

Attributes

communication_password
827ccb0eea8a706c4c34a16891f84e7b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

bf35c2910d407f1cf330f465a793dc1b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\BmUXYeTbHs5V2xGl\\jO7sI5nJfZMm.exe\",explorer.exe"	bf35c2910d407f1cf330f465a793dc1b.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

bf35c2910d407f1cf330f465a793dc1b.exe

pid	process
1200	bf35c2910d407f1cf330f465a793dc1b.exe
1200	bf35c2910d407f1cf330f465a793dc1b.exe
1200	bf35c2910d407f1cf330f465a793dc1b.exe
1200	bf35c2910d407f1cf330f465a793dc1b.exe
1200	bf35c2910d407f1cf330f465a793dc1b.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bf35c2910d407f1cf330f465a793dc1b.exe

description	pid	process
Token: SeDebugPrivilege	1200	bf35c2910d407f1cf330f465a793dc1b.exe
Token: SeDebugPrivilege	1200	bf35c2910d407f1cf330f465a793dc1b.exe
Token: SeDebugPrivilege	1200	bf35c2910d407f1cf330f465a793dc1b.exe
Token: SeShutdownPrivilege	1200	bf35c2910d407f1cf330f465a793dc1b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

bf35c2910d407f1cf330f465a793dc1b.exe

pid process

1200 bf35c2910d407f1cf330f465a793dc1b.exe
1200 bf35c2910d407f1cf330f465a793dc1b.exe

C:\Users\Admin\AppData\Local\Temp\bf35c2910d407f1cf330f465a793dc1b.exe
"C:\Users\Admin\AppData\Local\Temp\bf35c2910d407f1cf330f465a793dc1b.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1200

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-54-0x0000000000520000-0x0000000000560000-memory.dmp

Filesize
256KB

Download
memory/1200-55-0x0000000000520000-0x0000000000560000-memory.dmp

Filesize
256KB

Download
memory/1200-58-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Filesize
4KB

Download
memory/1200-59-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-63-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-62-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-61-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-65-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-66-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-67-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-68-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-69-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-70-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-71-0x0000000000200000-0x000000000020A000-memory.dmp

Filesize
40KB

Download
memory/1200-72-0x0000000000200000-0x000000000020A000-memory.dmp

Filesize
40KB

Download
memory/1200-73-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-74-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-77-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-80-0x0000000000200000-0x000000000020A000-memory.dmp

Filesize
40KB

Download
memory/1200-81-0x0000000000200000-0x000000000020A000-memory.dmp

Filesize
40KB

Download
memory/1200-82-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-86-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-88-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-92-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-94-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-98-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download
memory/1200-100-0x000000007EBD0000-0x000000007EF9E000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads