bitrat | c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e

General

Target

file.exe
Size

5.2MB
MD5

1a3c1fc575e887613a939ac922be008e
SHA1

bce9ae9150bee417870bbd81df0dd78de05b40ee
SHA256

c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e
SHA512

19da0246be7d04c7720e99cf02154e097d402f05bc64d775a476d5d5043d8f7453c93a6febb27e6662ac581f1ddbea0e326070ace38905652bd078d9e58221fd
SSDEEP

98304:Y99eu+2CsrmgBRcowzOCMOh7+HjCUPCS5AOoYSRVvpqWZ:4EsrmTTB5h7GCjYAO7SYWZ

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

aaaxxx60.hopto.org:400

Attributes

communication_password
827ccb0eea8a706c4c34a16891f84e7b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

RegSvcs.exe

pid process

1872 RegSvcs.exe
1872 RegSvcs.exe
1872 RegSvcs.exe
1872 RegSvcs.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 2040 set thread context of 1872 2040 file.exe RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1872 RegSvcs.exe
Token: SeShutdownPrivilege 1872 RegSvcs.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

file.exeRegSvcs.exe

pid process

2040 file.exe
1872 RegSvcs.exe
1872 RegSvcs.exe

pid	process
1872	RegSvcs.exe
1872	RegSvcs.exe
1872	RegSvcs.exe
1872	RegSvcs.exe

description	pid	process	target process
PID 2040 set thread context of 1872	2040	file.exe	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1872	RegSvcs.exe
Token: SeShutdownPrivilege	1872	RegSvcs.exe

pid	process
2040	file.exe
1872	RegSvcs.exe
1872	RegSvcs.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

file.exe

description	pid	process	target process
PID 2040 wrote to memory of 1872	2040	file.exe	RegSvcs.exe
PID 2040 wrote to memory of 1872	2040	file.exe	RegSvcs.exe
PID 2040 wrote to memory of 1872	2040	file.exe	RegSvcs.exe
PID 2040 wrote to memory of 1872	2040	file.exe	RegSvcs.exe
PID 2040 wrote to memory of 1872	2040	file.exe	RegSvcs.exe
PID 2040 wrote to memory of 1872	2040	file.exe	RegSvcs.exe
PID 2040 wrote to memory of 1872	2040	file.exe	RegSvcs.exe
PID 2040 wrote to memory of 1872	2040	file.exe	RegSvcs.exe
PID 2040 wrote to memory of 1872	2040	file.exe	RegSvcs.exe
PID 2040 wrote to memory of 1872	2040	file.exe	RegSvcs.exe
PID 2040 wrote to memory of 1872	2040	file.exe	RegSvcs.exe
PID 2040 wrote to memory of 1872	2040	file.exe	RegSvcs.exe
PID 2040 wrote to memory of 1872	2040	file.exe	RegSvcs.exe
PID 2040 wrote to memory of 1872	2040	file.exe	RegSvcs.exe
PID 2040 wrote to memory of 1872	2040	file.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1872-56-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-57-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-58-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-59-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-60-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-61-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-62-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1872-64-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-66-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-67-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-69-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-70-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-71-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-72-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-73-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-74-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-75-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-76-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-77-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-78-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-79-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-80-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-81-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1872-82-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads