bitrat | 2bcc4315b528b9e1b1896042dd07483b4f9275271f05fb484bd92c2cb2b13d97

General

Target

file.exe
Size

5.2MB
MD5

b5b0b3fcb71e4ca3f04996330b46d188
SHA1

4c04505fe7c398e139a4ce3cf80a217cc8b27dbe
SHA256

2bcc4315b528b9e1b1896042dd07483b4f9275271f05fb484bd92c2cb2b13d97
SHA512

0181090c9239e0957044065802bbc61c8cb0ffb9ea2559d2b988fce85b5ecdd26016b46b161c1b7716f76c90a63db56e862c6eaa050fb67a0c24de416f045441
SSDEEP

98304:0i0eu+2CsrmgBRcowzOCMOh7+HjCUPCS5AOoYSRVbpqWZ:LJsrmTTB5h7GCjYAO7SkWZ

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

aaaxxx60.hopto.org:400

Attributes

communication_password
827ccb0eea8a706c4c34a16891f84e7b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

calc.exe

pid process

1356 calc.exe
1356 calc.exe
1356 calc.exe
1356 calc.exe
1356 calc.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1304 set thread context of 1356 1304 file.exe calc.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

calc.exe

description pid process

Token: SeDebugPrivilege 1356 calc.exe
Token: SeShutdownPrivilege 1356 calc.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

file.execalc.exe

pid process

1304 file.exe
1356 calc.exe
1356 calc.exe

pid	process
1356	calc.exe
1356	calc.exe
1356	calc.exe
1356	calc.exe
1356	calc.exe

description	pid	process	target process
PID 1304 set thread context of 1356	1304	file.exe	calc.exe

description	pid	process
Token: SeDebugPrivilege	1356	calc.exe
Token: SeShutdownPrivilege	1356	calc.exe

pid	process
1304	file.exe
1356	calc.exe
1356	calc.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1304 wrote to memory of 1356	1304	file.exe	calc.exe
PID 1304 wrote to memory of 1356	1304	file.exe	calc.exe
PID 1304 wrote to memory of 1356	1304	file.exe	calc.exe
PID 1304 wrote to memory of 1356	1304	file.exe	calc.exe
PID 1304 wrote to memory of 1356	1304	file.exe	calc.exe
PID 1304 wrote to memory of 1356	1304	file.exe	calc.exe
PID 1304 wrote to memory of 1356	1304	file.exe	calc.exe
PID 1304 wrote to memory of 1356	1304	file.exe	calc.exe
PID 1304 wrote to memory of 1356	1304	file.exe	calc.exe
PID 1304 wrote to memory of 1356	1304	file.exe	calc.exe
PID 1304 wrote to memory of 1356	1304	file.exe	calc.exe
PID 1304 wrote to memory of 1356	1304	file.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\calc.exe
"C:\Windows\System32\calc.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-56-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-57-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-58-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-59-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-60-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-61-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-62-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1356-64-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-66-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-67-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-69-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-71-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-72-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-73-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-75-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-76-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-77-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-78-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/1356-79-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/1356-80-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-81-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-84-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/1356-85-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/1356-95-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-96-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-97-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-100-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-102-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-104-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-108-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-112-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-114-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-118-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-122-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1356-124-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads