bitrat | c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2023 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

5.2MB
MD5

1a3c1fc575e887613a939ac922be008e
SHA1

bce9ae9150bee417870bbd81df0dd78de05b40ee
SHA256

c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e
SHA512

19da0246be7d04c7720e99cf02154e097d402f05bc64d775a476d5d5043d8f7453c93a6febb27e6662ac581f1ddbea0e326070ace38905652bd078d9e58221fd
SSDEEP

98304:Y99eu+2CsrmgBRcowzOCMOh7+HjCUPCS5AOoYSRVvpqWZ:4EsrmTTB5h7GCjYAO7SYWZ

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

aaaxxx60.hopto.org:400

Attributes

communication_password
827ccb0eea8a706c4c34a16891f84e7b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

RegSvcs.exe

pid process

2912 RegSvcs.exe
2912 RegSvcs.exe
2912 RegSvcs.exe
2912 RegSvcs.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1628 set thread context of 2912 1628 file.exe RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeShutdownPrivilege 2912 RegSvcs.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

file.exeRegSvcs.exe

pid process

1628 file.exe
2912 RegSvcs.exe
2912 RegSvcs.exe

pid	process
2912	RegSvcs.exe
2912	RegSvcs.exe
2912	RegSvcs.exe
2912	RegSvcs.exe

description	pid	process	target process
PID 1628 set thread context of 2912	1628	file.exe	RegSvcs.exe

description	pid	process
Token: SeShutdownPrivilege	2912	RegSvcs.exe

pid	process
1628	file.exe
2912	RegSvcs.exe
2912	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1628 wrote to memory of 2912	1628	file.exe	RegSvcs.exe
PID 1628 wrote to memory of 2912	1628	file.exe	RegSvcs.exe
PID 1628 wrote to memory of 2912	1628	file.exe	RegSvcs.exe
PID 1628 wrote to memory of 2912	1628	file.exe	RegSvcs.exe
PID 1628 wrote to memory of 2912	1628	file.exe	RegSvcs.exe
PID 1628 wrote to memory of 2912	1628	file.exe	RegSvcs.exe
PID 1628 wrote to memory of 2912	1628	file.exe	RegSvcs.exe
PID 1628 wrote to memory of 2912	1628	file.exe	RegSvcs.exe
PID 1628 wrote to memory of 2912	1628	file.exe	RegSvcs.exe
PID 1628 wrote to memory of 2912	1628	file.exe	RegSvcs.exe
PID 1628 wrote to memory of 2912	1628	file.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-135-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-136-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-137-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-138-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-140-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-142-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-141-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-143-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-144-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-145-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-146-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-147-0x00000000746C0000-0x00000000746F9000-memory.dmp

Filesize
228KB

Download
memory/2912-148-0x0000000074A40000-0x0000000074A79000-memory.dmp

Filesize
228KB

Download
memory/2912-149-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-150-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-151-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-152-0x0000000074A40000-0x0000000074A79000-memory.dmp

Filesize
228KB

Download
memory/2912-153-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-154-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-155-0x0000000074A40000-0x0000000074A79000-memory.dmp

Filesize
228KB

Download
memory/2912-156-0x00000000746C0000-0x00000000746F9000-memory.dmp

Filesize
228KB

Download
memory/2912-157-0x0000000074A40000-0x0000000074A79000-memory.dmp

Filesize
228KB

Download
memory/2912-158-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-159-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-160-0x0000000074A40000-0x0000000074A79000-memory.dmp

Filesize
228KB

Download
memory/2912-161-0x0000000074A40000-0x0000000074A79000-memory.dmp

Filesize
228KB

Download
memory/2912-162-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-163-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2912-164-0x0000000074A40000-0x0000000074A79000-memory.dmp

Filesize
228KB

Download
memory/2912-165-0x0000000074A40000-0x0000000074A79000-memory.dmp

Filesize
228KB

Download