bitrat | 752de4a31961533190547dd1fe03bc8c0c0178c3a8512582ae56266e27e32c17

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2023 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1540c36f7454d7fc450d9ba1df2d0b27.exe
Size

4.0MB
MD5

1540c36f7454d7fc450d9ba1df2d0b27
SHA1

e67371197f6a0b3731f787d11db284f3d684997b
SHA256

752de4a31961533190547dd1fe03bc8c0c0178c3a8512582ae56266e27e32c17
SHA512

dde9a094e7e8089a2342c63a33a9e8c8cb46d4c341e7f8ff84489757928306d39172cf89e69ec56f3568cf5f8aa3ce7cadebb65d3058b14916e6444a92525162
SSDEEP

98304:OwyTkXTVa2bSFV5zNUFzbXottPXD5BYaHiuhg:OVkXTVaummbXott/9CM

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

8.208.27.150:4550

Attributes

communication_password
9996535e07258a7bbfd8b132435c5962
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	1540c36f7454d7fc450d9ba1df2d0b27.exe

Executes dropped EXE 1 IoCs

pid	Process
5116	pcshield.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1600	RegAsm.exe
1600	RegAsm.exe
1600	RegAsm.exe
1600	RegAsm.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	90
PID 5116 set thread context of 2132	5116	pcshield.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1152	2132	WerFault.exe	103

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
944	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe
Token: SeShutdownPrivilege	1600	RegAsm.exe
Token: SeDebugPrivilege	5116	pcshield.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1600	RegAsm.exe
1600	RegAsm.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	90
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	90
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	90
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	90
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	90
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	90
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	90
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	90
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	90
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	90
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	90
PID 4768 wrote to memory of 2268	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	97
PID 4768 wrote to memory of 2268	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	97
PID 4768 wrote to memory of 2268	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	97
PID 4768 wrote to memory of 4740	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	99
PID 4768 wrote to memory of 4740	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	99
PID 4768 wrote to memory of 4740	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	99
PID 2268 wrote to memory of 944	2268	cmd.exe	101
PID 2268 wrote to memory of 944	2268	cmd.exe	101
PID 2268 wrote to memory of 944	2268	cmd.exe	101
PID 5116 wrote to memory of 2132	5116	pcshield.exe	103
PID 5116 wrote to memory of 2132	5116	pcshield.exe	103
PID 5116 wrote to memory of 2132	5116	pcshield.exe	103
PID 5116 wrote to memory of 2132	5116	pcshield.exe	103
PID 5116 wrote to memory of 2132	5116	pcshield.exe	103
PID 5116 wrote to memory of 2132	5116	pcshield.exe	103
PID 5116 wrote to memory of 2132	5116	pcshield.exe	103
PID 5116 wrote to memory of 2132	5116	pcshield.exe	103
PID 5116 wrote to memory of 2132	5116	pcshield.exe	103
PID 5116 wrote to memory of 2132	5116	pcshield.exe	103
PID 5116 wrote to memory of 2132	5116	pcshield.exe	103

C:\Users\Admin\AppData\Local\Temp\1540c36f7454d7fc450d9ba1df2d0b27.exe
"C:\Users\Admin\AppData\Local\Temp\1540c36f7454d7fc450d9ba1df2d0b27.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1600
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Local\Temp\pcshield\pcshield.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Local\Temp\pcshield\pcshield.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\1540c36f7454d7fc450d9ba1df2d0b27.exe" "C:\Users\Admin\AppData\Local\Temp\pcshield\pcshield.exe"
  2⤵
  PID:4740

C:\Users\Admin\AppData\Local\Temp\pcshield\pcshield.exe
C:\Users\Admin\AppData\Local\Temp\pcshield\pcshield.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 540
    3⤵
    - Program crash
    PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2132 -ip 2132
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pcshield\pcshield.exe

Filesize
712KB

MD5
246c5c2e0bbbe6624990c857c82d6495

SHA1
b740b021e1fb7de634c91fc2981e13518648139b

SHA256
322a45b42194a943e889a87e423f09aacac4749fc96054bc02c936115acfd2fa

SHA512
a1fb631102e30b5bd403fedf4fd318b34e23bfb44edb48316d7504d3ec823dbfd8a3296dc464a45440f4244fe7a863c4d60231850ecbde7964a464ab188f896e

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcshield\pcshield.exe

Filesize
321KB

MD5
c626bcccfc34399a76ea390e383c3627

SHA1
62f243a0631efcc9b4d40ab4ce0c9db7a6ebd6dc

SHA256
310e06c4a3ab6d73126794dd4ec9f6a43dc9ced0112d8205c5a0d1d712386e17

SHA512
ae19b32ce9aea7dac631ec1ab3dff46b08351511db7caf481d525340f7ba2c1cefae193895dfd55d99b8d32008c4a28f596c97b4dc2f928ca825cc7b1ec6b5a5

Download Submit
memory/1600-34-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-16-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-50-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-52-0x0000000070B80000-0x0000000070BB9000-memory.dmp

Filesize
228KB

Download
memory/1600-6-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-8-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-51-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-10-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-11-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-12-0x0000000070AA0000-0x0000000070AD9000-memory.dmp

Filesize
228KB

Download
memory/1600-13-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-15-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-17-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-33-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-19-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-20-0x0000000070B80000-0x0000000070BB9000-memory.dmp

Filesize
228KB

Download
memory/1600-18-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-23-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-7-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-24-0x0000000070B80000-0x0000000070BB9000-memory.dmp

Filesize
228KB

Download
memory/1600-14-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-22-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-25-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-26-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-27-0x0000000070B80000-0x0000000070BB9000-memory.dmp

Filesize
228KB

Download
memory/1600-35-0x00000000755E0000-0x0000000075619000-memory.dmp

Filesize
228KB

Download
memory/2132-48-0x0000000000B50000-0x0000000000F1E000-memory.dmp

Filesize
3.8MB

Download
memory/2132-44-0x0000000000B50000-0x0000000000F1E000-memory.dmp

Filesize
3.8MB

Download
memory/2132-49-0x0000000000B50000-0x0000000000F1E000-memory.dmp

Filesize
3.8MB

Download
memory/4768-2-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/4768-30-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4768-0-0x0000000000A10000-0x0000000000E1C000-memory.dmp

Filesize
4.0MB

Download
memory/4768-28-0x00000000015D0000-0x0000000001636000-memory.dmp

Filesize
408KB

Download
memory/4768-3-0x0000000005DA0000-0x0000000006344000-memory.dmp

Filesize
5.6MB

Download
memory/4768-1-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4768-21-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4768-5-0x0000000005880000-0x000000000588A000-memory.dmp

Filesize
40KB

Download
memory/4768-4-0x0000000005890000-0x0000000005922000-memory.dmp

Filesize
584KB

Download
memory/5116-38-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/5116-53-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads