bitrat | c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-06-2023 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe
Size

5.2MB
MD5

1a3c1fc575e887613a939ac922be008e
SHA1

bce9ae9150bee417870bbd81df0dd78de05b40ee
SHA256

c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e
SHA512

19da0246be7d04c7720e99cf02154e097d402f05bc64d775a476d5d5043d8f7453c93a6febb27e6662ac581f1ddbea0e326070ace38905652bd078d9e58221fd
SSDEEP

98304:Y99eu+2CsrmgBRcowzOCMOh7+HjCUPCS5AOoYSRVvpqWZ:4EsrmTTB5h7GCjYAO7SYWZ

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

aaaxxx60.hopto.org:400

Attributes

communication_password
827ccb0eea8a706c4c34a16891f84e7b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

RegSvcs.exe

pid process

1624 RegSvcs.exe
1624 RegSvcs.exe
1624 RegSvcs.exe
1624 RegSvcs.exe
1624 RegSvcs.exe

pid	process
1624	RegSvcs.exe
1624	RegSvcs.exe
1624	RegSvcs.exe
1624	RegSvcs.exe
1624	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe

description	pid	process	target process
PID 1524 set thread context of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1624 RegSvcs.exe
Token: SeShutdownPrivilege 1624 RegSvcs.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exeRegSvcs.exe

pid process

1524 c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe
1624 RegSvcs.exe
1624 RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1624	RegSvcs.exe
Token: SeShutdownPrivilege	1624	RegSvcs.exe

pid	process
1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe
1624	RegSvcs.exe
1624	RegSvcs.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe

description	pid	process	target process
PID 1524 wrote to memory of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe
PID 1524 wrote to memory of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe
PID 1524 wrote to memory of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe
PID 1524 wrote to memory of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe
PID 1524 wrote to memory of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe
PID 1524 wrote to memory of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe
PID 1524 wrote to memory of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe
PID 1524 wrote to memory of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe
PID 1524 wrote to memory of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe
PID 1524 wrote to memory of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe
PID 1524 wrote to memory of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe
PID 1524 wrote to memory of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe
PID 1524 wrote to memory of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe
PID 1524 wrote to memory of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe
PID 1524 wrote to memory of 1624	1524	c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe
"C:\Users\Admin\AppData\Local\Temp\c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-56-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-57-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-58-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-59-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-60-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-61-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1624-62-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-64-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-66-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-67-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-68-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-69-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-71-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-73-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-74-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-75-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-76-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-77-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-78-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-79-0x0000000000290000-0x000000000029A000-memory.dmp

Filesize
40KB

Download
memory/1624-80-0x0000000000290000-0x000000000029A000-memory.dmp

Filesize
40KB

Download
memory/1624-81-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-83-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-84-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-87-0x0000000000290000-0x000000000029A000-memory.dmp

Filesize
40KB

Download
memory/1624-88-0x0000000000290000-0x000000000029A000-memory.dmp

Filesize
40KB

Download
memory/1624-89-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-91-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-95-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-97-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-101-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-103-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-107-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-110-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-113-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-117-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-119-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1624-123-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download