bitrat | 6920c222d9646d2f191e93a2a0f5ea080615ddc88f0b65d18342eb335dfa480c

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20-08-2023 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hmAa.exe
Size

1.5MB
MD5

bdd1438c98225e3ea172ec284a6708f9
SHA1

0d1e23278ef4346d2a051f35d4cecf30199e6eae
SHA256

6920c222d9646d2f191e93a2a0f5ea080615ddc88f0b65d18342eb335dfa480c
SHA512

7847f435bf73205fc0f2354c4d80c16d414f2f9076a5a725cbac2bd53d72b7b0f52c5e321d03915a1e9209e99006398d6208ef66c5e77190a256b9067ad2f3a4
SSDEEP

49152:VU7EGUTipLZ+DYQ1dKrHIdbbwPk+1ddjjt2:C7EZG/+DYwdKrap+1d

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

bitrat9300.duckdns.org:9300

Attributes

communication_password
e10adc3949ba59abbe56e057f20f883e
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Executes dropped EXE 2 IoCs

Processes:

rttre.exerttre.exe

pid process

2296 rttre.exe
364 rttre.exe

pid	process
2296	rttre.exe
364	rttre.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2936-61-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-62-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-65-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-67-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-66-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-68-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-69-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-73-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-75-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-74-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-77-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-78-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-79-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-80-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-81-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-84-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-85-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-86-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-87-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-88-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-94-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-103-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-109-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-113-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/1880-124-0x00000000006E0000-0x0000000000AC4000-memory.dmp	upx
behavioral1/memory/1880-123-0x00000000006E0000-0x0000000000AC4000-memory.dmp	upx
behavioral1/memory/1880-126-0x00000000006E0000-0x0000000000AC4000-memory.dmp	upx
behavioral1/memory/1880-125-0x00000000006E0000-0x0000000000AC4000-memory.dmp	upx
behavioral1/memory/1880-128-0x00000000006E0000-0x0000000000AC4000-memory.dmp	upx
behavioral1/memory/1880-129-0x00000000006E0000-0x0000000000AC4000-memory.dmp	upx
behavioral1/memory/2936-130-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-134-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx
behavioral1/memory/2936-138-0x00000000006B0000-0x0000000000A94000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

vbc.exevbc.exe

pid process

2936 vbc.exe
2936 vbc.exe
2936 vbc.exe
2936 vbc.exe
2936 vbc.exe
1880 vbc.exe
Suspicious use of SetThreadContext 2 IoCs

Processes:

hmAa.exerttre.exe

description pid process target process

PID 1972 set thread context of 2936 1972 hmAa.exe vbc.exe
PID 2296 set thread context of 1880 2296 rttre.exe vbc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2868 schtasks.exe
1336 schtasks.exe

pid	process
2936	vbc.exe
2936	vbc.exe
2936	vbc.exe
2936	vbc.exe
2936	vbc.exe
1880	vbc.exe

description	pid	process	target process
PID 1972 set thread context of 2936	1972	hmAa.exe	vbc.exe
PID 2296 set thread context of 1880	2296	rttre.exe	vbc.exe

pid	process
2868	schtasks.exe
1336	schtasks.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

vbc.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	2936	vbc.exe
Token: SeShutdownPrivilege	2936	vbc.exe
Token: SeDebugPrivilege	1880	vbc.exe
Token: SeShutdownPrivilege	1880	vbc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

vbc.exe

pid process

2936 vbc.exe
2936 vbc.exe

pid	process
2936	vbc.exe
2936	vbc.exe

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

hmAa.execmd.exetaskeng.exerttre.execmd.exe

description	pid	process	target process
PID 1972 wrote to memory of 2936	1972	hmAa.exe	vbc.exe
PID 1972 wrote to memory of 2936	1972	hmAa.exe	vbc.exe
PID 1972 wrote to memory of 2936	1972	hmAa.exe	vbc.exe
PID 1972 wrote to memory of 2936	1972	hmAa.exe	vbc.exe
PID 1972 wrote to memory of 2936	1972	hmAa.exe	vbc.exe
PID 1972 wrote to memory of 2936	1972	hmAa.exe	vbc.exe
PID 1972 wrote to memory of 2936	1972	hmAa.exe	vbc.exe
PID 1972 wrote to memory of 2936	1972	hmAa.exe	vbc.exe
PID 1972 wrote to memory of 2864	1972	hmAa.exe	cmd.exe
PID 1972 wrote to memory of 2864	1972	hmAa.exe	cmd.exe
PID 1972 wrote to memory of 2864	1972	hmAa.exe	cmd.exe
PID 1972 wrote to memory of 2864	1972	hmAa.exe	cmd.exe
PID 1972 wrote to memory of 1748	1972	hmAa.exe	cmd.exe
PID 1972 wrote to memory of 1748	1972	hmAa.exe	cmd.exe
PID 1972 wrote to memory of 1748	1972	hmAa.exe	cmd.exe
PID 1972 wrote to memory of 1748	1972	hmAa.exe	cmd.exe
PID 1748 wrote to memory of 2868	1748	cmd.exe	schtasks.exe
PID 1748 wrote to memory of 2868	1748	cmd.exe	schtasks.exe
PID 1748 wrote to memory of 2868	1748	cmd.exe	schtasks.exe
PID 1748 wrote to memory of 2868	1748	cmd.exe	schtasks.exe
PID 1972 wrote to memory of 2880	1972	hmAa.exe	cmd.exe
PID 1972 wrote to memory of 2880	1972	hmAa.exe	cmd.exe
PID 1972 wrote to memory of 2880	1972	hmAa.exe	cmd.exe
PID 1972 wrote to memory of 2880	1972	hmAa.exe	cmd.exe
PID 1620 wrote to memory of 2296	1620	taskeng.exe	rttre.exe
PID 1620 wrote to memory of 2296	1620	taskeng.exe	rttre.exe
PID 1620 wrote to memory of 2296	1620	taskeng.exe	rttre.exe
PID 1620 wrote to memory of 2296	1620	taskeng.exe	rttre.exe
PID 2296 wrote to memory of 1880	2296	rttre.exe	vbc.exe
PID 2296 wrote to memory of 1880	2296	rttre.exe	vbc.exe
PID 2296 wrote to memory of 1880	2296	rttre.exe	vbc.exe
PID 2296 wrote to memory of 1880	2296	rttre.exe	vbc.exe
PID 2296 wrote to memory of 1880	2296	rttre.exe	vbc.exe
PID 2296 wrote to memory of 1880	2296	rttre.exe	vbc.exe
PID 2296 wrote to memory of 1880	2296	rttre.exe	vbc.exe
PID 2296 wrote to memory of 1880	2296	rttre.exe	vbc.exe
PID 2296 wrote to memory of 2776	2296	rttre.exe	cmd.exe
PID 2296 wrote to memory of 2776	2296	rttre.exe	cmd.exe
PID 2296 wrote to memory of 2776	2296	rttre.exe	cmd.exe
PID 2296 wrote to memory of 2776	2296	rttre.exe	cmd.exe
PID 2296 wrote to memory of 1220	2296	rttre.exe	cmd.exe
PID 2296 wrote to memory of 1220	2296	rttre.exe	cmd.exe
PID 2296 wrote to memory of 1220	2296	rttre.exe	cmd.exe
PID 2296 wrote to memory of 1220	2296	rttre.exe	cmd.exe
PID 1220 wrote to memory of 1336	1220	cmd.exe	schtasks.exe
PID 1220 wrote to memory of 1336	1220	cmd.exe	schtasks.exe
PID 1220 wrote to memory of 1336	1220	cmd.exe	schtasks.exe
PID 1220 wrote to memory of 1336	1220	cmd.exe	schtasks.exe
PID 2296 wrote to memory of 1252	2296	rttre.exe	cmd.exe
PID 2296 wrote to memory of 1252	2296	rttre.exe	cmd.exe
PID 2296 wrote to memory of 1252	2296	rttre.exe	cmd.exe
PID 2296 wrote to memory of 1252	2296	rttre.exe	cmd.exe
PID 1620 wrote to memory of 364	1620	taskeng.exe	rttre.exe
PID 1620 wrote to memory of 364	1620	taskeng.exe	rttre.exe
PID 1620 wrote to memory of 364	1620	taskeng.exe	rttre.exe
PID 1620 wrote to memory of 364	1620	taskeng.exe	rttre.exe

C:\Users\Admin\AppData\Local\Temp\hmAa.exe
"C:\Users\Admin\AppData\Local\Temp\hmAa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2936

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\Temp\rttre"
2⤵
PID:2864

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe'" /f
3⤵
- Creates scheduled task(s)
PID:2868

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\hmAa.exe" "C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe"
2⤵
PID:2880

C:\Windows\system32\taskeng.exe
taskeng.exe {0216AE16-0AA9-4748-A769-8F022AFF0ACC} S-1-5-21-377084978-2088738870-2818360375-1000:DSWJWADP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe
C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2296

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\Temp\rttre"
3⤵
PID:2776

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe'" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe" "C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe"
3⤵
PID:1252

C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe
C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe
2⤵
- Executes dropped EXE
PID:364

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe

Filesize
1.5MB

MD5
bdd1438c98225e3ea172ec284a6708f9

SHA1
0d1e23278ef4346d2a051f35d4cecf30199e6eae

SHA256
6920c222d9646d2f191e93a2a0f5ea080615ddc88f0b65d18342eb335dfa480c

SHA512
7847f435bf73205fc0f2354c4d80c16d414f2f9076a5a725cbac2bd53d72b7b0f52c5e321d03915a1e9209e99006398d6208ef66c5e77190a256b9067ad2f3a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe

Filesize
1.5MB

MD5
bdd1438c98225e3ea172ec284a6708f9

SHA1
0d1e23278ef4346d2a051f35d4cecf30199e6eae

SHA256
6920c222d9646d2f191e93a2a0f5ea080615ddc88f0b65d18342eb335dfa480c

SHA512
7847f435bf73205fc0f2354c4d80c16d414f2f9076a5a725cbac2bd53d72b7b0f52c5e321d03915a1e9209e99006398d6208ef66c5e77190a256b9067ad2f3a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe

Filesize
1.5MB

MD5
bdd1438c98225e3ea172ec284a6708f9

SHA1
0d1e23278ef4346d2a051f35d4cecf30199e6eae

SHA256
6920c222d9646d2f191e93a2a0f5ea080615ddc88f0b65d18342eb335dfa480c

SHA512
7847f435bf73205fc0f2354c4d80c16d414f2f9076a5a725cbac2bd53d72b7b0f52c5e321d03915a1e9209e99006398d6208ef66c5e77190a256b9067ad2f3a4

Download Submit
memory/364-143-0x00000000049C0000-0x0000000004A00000-memory.dmp

Filesize
256KB

Download
memory/364-148-0x00000000739E0000-0x00000000740CE000-memory.dmp

Filesize
6.9MB

Download
memory/364-142-0x00000000000F0000-0x000000000027A000-memory.dmp

Filesize
1.5MB

Download
memory/364-141-0x00000000739E0000-0x00000000740CE000-memory.dmp

Filesize
6.9MB

Download
memory/1880-123-0x00000000006E0000-0x0000000000AC4000-memory.dmp

Filesize
3.9MB

Download
memory/1880-125-0x00000000006E0000-0x0000000000AC4000-memory.dmp

Filesize
3.9MB

Download
memory/1880-124-0x00000000006E0000-0x0000000000AC4000-memory.dmp

Filesize
3.9MB

Download
memory/1880-129-0x00000000006E0000-0x0000000000AC4000-memory.dmp

Filesize
3.9MB

Download
memory/1880-128-0x00000000006E0000-0x0000000000AC4000-memory.dmp

Filesize
3.9MB

Download
memory/1880-126-0x00000000006E0000-0x0000000000AC4000-memory.dmp

Filesize
3.9MB

Download
memory/1972-58-0x0000000004340000-0x0000000004380000-memory.dmp

Filesize
256KB

Download
memory/1972-72-0x0000000073E40000-0x000000007452E000-memory.dmp

Filesize
6.9MB

Download
memory/1972-55-0x0000000073E40000-0x000000007452E000-memory.dmp

Filesize
6.9MB

Download
memory/1972-57-0x0000000073E40000-0x000000007452E000-memory.dmp

Filesize
6.9MB

Download
memory/1972-56-0x0000000004340000-0x0000000004380000-memory.dmp

Filesize
256KB

Download
memory/1972-54-0x0000000000260000-0x00000000003EA000-memory.dmp

Filesize
1.5MB

Download
memory/2296-127-0x00000000739B0000-0x000000007409E000-memory.dmp

Filesize
6.9MB

Download
memory/2296-102-0x0000000000270000-0x00000000002B0000-memory.dmp

Filesize
256KB

Download
memory/2296-100-0x00000000739B0000-0x000000007409E000-memory.dmp

Filesize
6.9MB

Download
memory/2296-101-0x0000000000A10000-0x0000000000B9A000-memory.dmp

Filesize
1.5MB

Download
memory/2296-105-0x00000000739B0000-0x000000007409E000-memory.dmp

Filesize
6.9MB

Download
memory/2296-108-0x0000000000270000-0x00000000002B0000-memory.dmp

Filesize
256KB

Download
memory/2936-87-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-113-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-86-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-84-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-88-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-90-0x0000000000090000-0x000000000009A000-memory.dmp

Filesize
40KB

Download
memory/2936-91-0x0000000000090000-0x000000000009A000-memory.dmp

Filesize
40KB

Download
memory/2936-94-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-82-0x0000000000090000-0x000000000009A000-memory.dmp

Filesize
40KB

Download
memory/2936-83-0x0000000000090000-0x000000000009A000-memory.dmp

Filesize
40KB

Download
memory/2936-81-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-80-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-79-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-103-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-78-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-77-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-109-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-85-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-74-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-75-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-73-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-69-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-68-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-66-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-67-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-130-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-134-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-138-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-65-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-64-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2936-62-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-61-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download
memory/2936-59-0x00000000006B0000-0x0000000000A94000-memory.dmp

Filesize
3.9MB

Download