bitrat | 2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb

General

Target

2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exe
Size

2.9MB
MD5

5b374f9893598fb7323a6fcc8a773418
SHA1

6fc6e18654fe76c2f057905ead38eadee0510e14
SHA256

2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb
SHA512

565970252145bc7f7ce692a5df60f83671c2ee7579d4779f95f8b2abca7c5764f9734fd1a2a898204e6f1d77361554da78162567e47bfed81ec83877a92b4d6e
SSDEEP

49152:kypQPq91dnWo21VjJVnDZo23Y2cj2/A4BD9DpTGqEme2CdXPckRBSBjTF:kybnWo2LjPDZB3Ypj2/AsrhE728XKF

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.34

C2

gordon6.hopto.org:1515

Attributes

communication_password
827ccb0eea8a706c4c34a16891f84e7b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4312-8-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-9-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-11-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-13-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-15-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-17-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-18-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-19-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-20-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-21-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-22-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-23-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-25-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-26-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-27-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-29-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-30-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-34-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4312-35-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

AddInProcess32.exe

pid process

4312 AddInProcess32.exe
4312 AddInProcess32.exe
4312 AddInProcess32.exe
4312 AddInProcess32.exe

pid	process
4312	AddInProcess32.exe
4312	AddInProcess32.exe
4312	AddInProcess32.exe
4312	AddInProcess32.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exe

description	pid	process	target process
PID 5068 set thread context of 4312	5068	2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exe	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exeAddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	5068	2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exe
Token: SeShutdownPrivilege	4312	AddInProcess32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AddInProcess32.exe

pid process

4312 AddInProcess32.exe
4312 AddInProcess32.exe

pid	process
4312	AddInProcess32.exe
4312	AddInProcess32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exe

description	pid	process	target process
PID 5068 wrote to memory of 4312	5068	2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exe	AddInProcess32.exe
PID 5068 wrote to memory of 4312	5068	2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exe	AddInProcess32.exe
PID 5068 wrote to memory of 4312	5068	2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exe	AddInProcess32.exe
PID 5068 wrote to memory of 4312	5068	2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exe	AddInProcess32.exe
PID 5068 wrote to memory of 4312	5068	2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exe	AddInProcess32.exe
PID 5068 wrote to memory of 4312	5068	2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exe	AddInProcess32.exe
PID 5068 wrote to memory of 4312	5068	2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exe	AddInProcess32.exe
PID 5068 wrote to memory of 4312	5068	2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exe
"C:\Users\Admin\AppData\Local\Temp\2d4c73a07bc7f749b009ca30d6527ad8c25b6a6c107df5aef95ec311b5016cdb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4312-18-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-27-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-36-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/4312-19-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-34-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-20-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-33-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/4312-32-0x0000000074D70000-0x0000000074DA9000-memory.dmp

Filesize
228KB

Download
memory/4312-8-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-9-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-11-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-13-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-31-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/4312-15-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-16-0x0000000074D70000-0x0000000074DA9000-memory.dmp

Filesize
228KB

Download
memory/4312-17-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-35-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-30-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-29-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-21-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-22-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-23-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-24-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/4312-25-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-26-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/4312-28-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/5068-0-0x0000000000710000-0x00000000009FA000-memory.dmp

Filesize
2.9MB

Download
memory/5068-5-0x00000000054A0000-0x00000000054AA000-memory.dmp

Filesize
40KB

Download
memory/5068-3-0x0000000005400000-0x0000000005492000-memory.dmp

Filesize
584KB

Download
memory/5068-14-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/5068-7-0x00000000055B0000-0x00000000055C0000-memory.dmp

Filesize
64KB

Download
memory/5068-6-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/5068-4-0x00000000055B0000-0x00000000055C0000-memory.dmp

Filesize
64KB

Download
memory/5068-1-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/5068-2-0x0000000005A70000-0x0000000006014000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads