bitrat | 1da5b144be7b321399e604ff0173fd831c9cd0588365f3dbf9f08a68d943b4d5

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01-09-2023 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nomal1.exe
Size

3.8MB
MD5

5c97b08df1ac8a00b3a618ec5a26aeae
SHA1

3bcbff269229cb6a27f0f1554a845874b42d11a3
SHA256

1da5b144be7b321399e604ff0173fd831c9cd0588365f3dbf9f08a68d943b4d5
SHA512

a8c679d0386468e5e9b44f873c56bb5ae56ecc92d05f80d52550eca3dca3e915c1657986969d63a434f93eaff20c85b4cbb8eca363fd4131454c00a4eb9003f5
SSDEEP

98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/9mlwXVZ4FB:5+R/eZADUXR

Score

10^/10

bitrat persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

rornfl12.duckdns.org:3072

Attributes

communication_password
81dc9bdb52d04dc20036dbd8313ed055
install_dir
chrome
install_file
updater
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

nomal1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows\CurrentVersion\Run\updater = "C:\\Users\\Admin\\AppData\\Local\\chrome\\updater"	nomal1.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

nomal1.exe

pid process

2204 nomal1.exe
2204 nomal1.exe
2204 nomal1.exe
2204 nomal1.exe
2204 nomal1.exe

Suspicious behavior: RenamesItself 30 IoCs

Processes:

nomal1.exe

pid	process
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe
2204	nomal1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

nomal1.exe

description pid process

Token: SeDebugPrivilege 2204 nomal1.exe
Token: SeShutdownPrivilege 2204 nomal1.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

nomal1.exe

pid process

2204 nomal1.exe
2204 nomal1.exe

description	pid	process
Token: SeDebugPrivilege	2204	nomal1.exe
Token: SeShutdownPrivilege	2204	nomal1.exe

C:\Users\Admin\AppData\Local\Temp\nomal1.exe
"C:\Users\Admin\AppData\Local\Temp\nomal1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2204

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2204-0-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2204-1-0x00000000002E0000-0x00000000002EA000-memory.dmp

Filesize
40KB

Download
memory/2204-2-0x00000000002E0000-0x00000000002EA000-memory.dmp

Filesize
40KB

Download
memory/2204-3-0x00000000002E0000-0x00000000002EA000-memory.dmp

Filesize
40KB

Download
memory/2204-4-0x00000000002E0000-0x00000000002EA000-memory.dmp

Filesize
40KB

Download