bitrat | 6920c222d9646d2f191e93a2a0f5ea080615ddc88f0b65d18342eb335dfa480c

General

Target

hmAa.exe
Size

1.5MB
MD5

bdd1438c98225e3ea172ec284a6708f9
SHA1

0d1e23278ef4346d2a051f35d4cecf30199e6eae
SHA256

6920c222d9646d2f191e93a2a0f5ea080615ddc88f0b65d18342eb335dfa480c
SHA512

7847f435bf73205fc0f2354c4d80c16d414f2f9076a5a725cbac2bd53d72b7b0f52c5e321d03915a1e9209e99006398d6208ef66c5e77190a256b9067ad2f3a4
SSDEEP

49152:VU7EGUTipLZ+DYQ1dKrHIdbbwPk+1ddjjt2:C7EZG/+DYwdKrap+1d

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

bitrat9300.duckdns.org:9300

Attributes

communication_password
e10adc3949ba59abbe56e057f20f883e
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Executes dropped EXE 2 IoCs

Processes:

rttre.exerttre.exe

pid process

5036 rttre.exe
2756 rttre.exe

pid	process
5036	rttre.exe
2756	rttre.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/216-138-0x00000000005C0000-0x00000000009A4000-memory.dmp	upx
behavioral2/memory/216-139-0x00000000005C0000-0x00000000009A4000-memory.dmp	upx
behavioral2/memory/216-140-0x00000000005C0000-0x00000000009A4000-memory.dmp	upx
behavioral2/memory/3828-152-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3828-153-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3828-154-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3828-157-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3828-159-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3828-165-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3828-167-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3828-168-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3828-169-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3828-170-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3828-171-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3828-172-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3828-173-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3828-177-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

vbc.exe

pid process

3828 vbc.exe
3828 vbc.exe
3828 vbc.exe
3828 vbc.exe
3828 vbc.exe
Suspicious use of SetThreadContext 2 IoCs

Processes:

hmAa.exerttre.exe

description pid process target process

PID 3644 set thread context of 216 3644 hmAa.exe vbc.exe
PID 5036 set thread context of 3828 5036 rttre.exe vbc.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4404 216 WerFault.exe vbc.exe
3880 216 WerFault.exe vbc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1916 schtasks.exe
1608 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vbc.exe

description pid process

Token: SeShutdownPrivilege 3828 vbc.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

vbc.exe

pid process

3828 vbc.exe
3828 vbc.exe

pid	process
3828	vbc.exe
3828	vbc.exe
3828	vbc.exe
3828	vbc.exe
3828	vbc.exe

description	pid	process	target process
PID 3644 set thread context of 216	3644	hmAa.exe	vbc.exe
PID 5036 set thread context of 3828	5036	rttre.exe	vbc.exe

pid	pid_target	process	target process
4404	216	WerFault.exe	vbc.exe
3880	216	WerFault.exe	vbc.exe

pid	process
1916	schtasks.exe
1608	schtasks.exe

description	pid	process
Token: SeShutdownPrivilege	3828	vbc.exe

pid	process
3828	vbc.exe
3828	vbc.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

hmAa.execmd.exerttre.execmd.exe

description	pid	process	target process
PID 3644 wrote to memory of 216	3644	hmAa.exe	vbc.exe
PID 3644 wrote to memory of 216	3644	hmAa.exe	vbc.exe
PID 3644 wrote to memory of 216	3644	hmAa.exe	vbc.exe
PID 3644 wrote to memory of 216	3644	hmAa.exe	vbc.exe
PID 3644 wrote to memory of 216	3644	hmAa.exe	vbc.exe
PID 3644 wrote to memory of 216	3644	hmAa.exe	vbc.exe
PID 3644 wrote to memory of 216	3644	hmAa.exe	vbc.exe
PID 3644 wrote to memory of 5056	3644	hmAa.exe	cmd.exe
PID 3644 wrote to memory of 5056	3644	hmAa.exe	cmd.exe
PID 3644 wrote to memory of 5056	3644	hmAa.exe	cmd.exe
PID 3644 wrote to memory of 3268	3644	hmAa.exe	cmd.exe
PID 3644 wrote to memory of 3268	3644	hmAa.exe	cmd.exe
PID 3644 wrote to memory of 3268	3644	hmAa.exe	cmd.exe
PID 3268 wrote to memory of 1916	3268	cmd.exe	schtasks.exe
PID 3268 wrote to memory of 1916	3268	cmd.exe	schtasks.exe
PID 3268 wrote to memory of 1916	3268	cmd.exe	schtasks.exe
PID 3644 wrote to memory of 3852	3644	hmAa.exe	cmd.exe
PID 3644 wrote to memory of 3852	3644	hmAa.exe	cmd.exe
PID 3644 wrote to memory of 3852	3644	hmAa.exe	cmd.exe
PID 5036 wrote to memory of 3828	5036	rttre.exe	vbc.exe
PID 5036 wrote to memory of 3828	5036	rttre.exe	vbc.exe
PID 5036 wrote to memory of 3828	5036	rttre.exe	vbc.exe
PID 5036 wrote to memory of 3828	5036	rttre.exe	vbc.exe
PID 5036 wrote to memory of 3828	5036	rttre.exe	vbc.exe
PID 5036 wrote to memory of 3828	5036	rttre.exe	vbc.exe
PID 5036 wrote to memory of 3828	5036	rttre.exe	vbc.exe
PID 5036 wrote to memory of 3692	5036	rttre.exe	cmd.exe
PID 5036 wrote to memory of 3692	5036	rttre.exe	cmd.exe
PID 5036 wrote to memory of 3692	5036	rttre.exe	cmd.exe
PID 5036 wrote to memory of 2292	5036	rttre.exe	cmd.exe
PID 5036 wrote to memory of 2292	5036	rttre.exe	cmd.exe
PID 5036 wrote to memory of 2292	5036	rttre.exe	cmd.exe
PID 2292 wrote to memory of 1608	2292	cmd.exe	schtasks.exe
PID 2292 wrote to memory of 1608	2292	cmd.exe	schtasks.exe
PID 2292 wrote to memory of 1608	2292	cmd.exe	schtasks.exe
PID 5036 wrote to memory of 4448	5036	rttre.exe	cmd.exe
PID 5036 wrote to memory of 4448	5036	rttre.exe	cmd.exe
PID 5036 wrote to memory of 4448	5036	rttre.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\hmAa.exe
"C:\Users\Admin\AppData\Local\Temp\hmAa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 184
3⤵
- Program crash
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 208
3⤵
- Program crash
PID:3880

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\Temp\rttre"
2⤵
PID:5056

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:3268

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe'" /f
3⤵
- Creates scheduled task(s)
PID:1916

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\hmAa.exe" "C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe"
2⤵
PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 216 -ip 216
1⤵
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 216 -ip 216
1⤵
PID:4364

C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe
C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3828

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\Temp\rttre"
2⤵
PID:3692

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe'" /f
3⤵
- Creates scheduled task(s)
PID:1608

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe" "C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe"
2⤵
PID:4448

C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe
C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe
1⤵
- Executes dropped EXE
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scripting

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe

Filesize
1.5MB

MD5
bdd1438c98225e3ea172ec284a6708f9

SHA1
0d1e23278ef4346d2a051f35d4cecf30199e6eae

SHA256
6920c222d9646d2f191e93a2a0f5ea080615ddc88f0b65d18342eb335dfa480c

SHA512
7847f435bf73205fc0f2354c4d80c16d414f2f9076a5a725cbac2bd53d72b7b0f52c5e321d03915a1e9209e99006398d6208ef66c5e77190a256b9067ad2f3a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe

Filesize
1.5MB

MD5
bdd1438c98225e3ea172ec284a6708f9

SHA1
0d1e23278ef4346d2a051f35d4cecf30199e6eae

SHA256
6920c222d9646d2f191e93a2a0f5ea080615ddc88f0b65d18342eb335dfa480c

SHA512
7847f435bf73205fc0f2354c4d80c16d414f2f9076a5a725cbac2bd53d72b7b0f52c5e321d03915a1e9209e99006398d6208ef66c5e77190a256b9067ad2f3a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe

Filesize
429KB

MD5
0acd4bb265d05c9ed25c7737da8e55c6

SHA1
ef4d0ac65726e8449d3e73d6a3bcc98673d9fba7

SHA256
738c2be922547551fbcf59cd2d095238cc9deef6b3089146a8d3fe70bcc98b18

SHA512
11d5289eb9f9b74430a5349d135eb3f6d84cae7f4a6b9fcf73cbb2be9c9f3ec86c0ff9b43b1bd8b6a731ed9c242392b3068703027f8c267a90dac85531c5fae3

Download Submit
memory/216-138-0x00000000005C0000-0x00000000009A4000-memory.dmp

Filesize
3.9MB

Download
memory/216-139-0x00000000005C0000-0x00000000009A4000-memory.dmp

Filesize
3.9MB

Download
memory/216-140-0x00000000005C0000-0x00000000009A4000-memory.dmp

Filesize
3.9MB

Download
memory/3644-133-0x00000000005F0000-0x000000000077A000-memory.dmp

Filesize
1.5MB

Download
memory/3644-134-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download
memory/3644-135-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download
memory/3644-136-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download
memory/3644-137-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download
memory/3644-144-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download
memory/3828-153-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3828-171-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3828-177-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3828-152-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3828-173-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3828-154-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3828-172-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3828-157-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3828-158-0x0000000075140000-0x0000000075179000-memory.dmp

Filesize
228KB

Download
memory/3828-159-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3828-165-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3828-166-0x00000000754C0000-0x00000000754F9000-memory.dmp

Filesize
228KB

Download
memory/3828-167-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3828-168-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3828-169-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3828-170-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5036-149-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download
memory/5036-156-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download
memory/5036-148-0x0000000005800000-0x0000000005810000-memory.dmp

Filesize
64KB

Download
memory/5036-150-0x0000000005800000-0x0000000005810000-memory.dmp

Filesize
64KB

Download
memory/5036-147-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads