bitrat | 752de4a31961533190547dd1fe03bc8c0c0178c3a8512582ae56266e27e32c17

General

Target

1540c36f7454d7fc450d9ba1df2d0b27.exe
Size

4.0MB
MD5

1540c36f7454d7fc450d9ba1df2d0b27
SHA1

e67371197f6a0b3731f787d11db284f3d684997b
SHA256

752de4a31961533190547dd1fe03bc8c0c0178c3a8512582ae56266e27e32c17
SHA512

dde9a094e7e8089a2342c63a33a9e8c8cb46d4c341e7f8ff84489757928306d39172cf89e69ec56f3568cf5f8aa3ce7cadebb65d3058b14916e6444a92525162
SSDEEP

98304:OwyTkXTVa2bSFV5zNUFzbXottPXD5BYaHiuhg:OVkXTVaummbXott/9CM

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

8.208.27.150:4550

Attributes

communication_password
9996535e07258a7bbfd8b132435c5962
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1540c36f7454d7fc450d9ba1df2d0b27.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	1540c36f7454d7fc450d9ba1df2d0b27.exe

Executes dropped EXE 1 IoCs

Processes:

pcshield.exe

pid process

5116 pcshield.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

RegAsm.exe

pid process

1600 RegAsm.exe
1600 RegAsm.exe
1600 RegAsm.exe
1600 RegAsm.exe

pid	process
5116	pcshield.exe

pid	process
1600	RegAsm.exe
1600	RegAsm.exe
1600	RegAsm.exe
1600	RegAsm.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

1540c36f7454d7fc450d9ba1df2d0b27.exepcshield.exe

description	pid	process	target process
PID 4768 set thread context of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	RegAsm.exe
PID 5116 set thread context of 2132	5116	pcshield.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1152 2132 WerFault.exe RegAsm.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

944 schtasks.exe

pid	pid_target	process	target process
1152	2132	WerFault.exe	RegAsm.exe

pid	process
944	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

1540c36f7454d7fc450d9ba1df2d0b27.exeRegAsm.exepcshield.exe

description	pid	process
Token: SeDebugPrivilege	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe
Token: SeShutdownPrivilege	1600	RegAsm.exe
Token: SeDebugPrivilege	5116	pcshield.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

RegAsm.exe

pid process

1600 RegAsm.exe
1600 RegAsm.exe

pid	process
1600	RegAsm.exe
1600	RegAsm.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

1540c36f7454d7fc450d9ba1df2d0b27.execmd.exepcshield.exe

description	pid	process	target process
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	RegAsm.exe
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	RegAsm.exe
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	RegAsm.exe
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	RegAsm.exe
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	RegAsm.exe
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	RegAsm.exe
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	RegAsm.exe
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	RegAsm.exe
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	RegAsm.exe
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	RegAsm.exe
PID 4768 wrote to memory of 1600	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	RegAsm.exe
PID 4768 wrote to memory of 2268	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	cmd.exe
PID 4768 wrote to memory of 2268	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	cmd.exe
PID 4768 wrote to memory of 2268	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	cmd.exe
PID 4768 wrote to memory of 4740	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	cmd.exe
PID 4768 wrote to memory of 4740	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	cmd.exe
PID 4768 wrote to memory of 4740	4768	1540c36f7454d7fc450d9ba1df2d0b27.exe	cmd.exe
PID 2268 wrote to memory of 944	2268	cmd.exe	schtasks.exe
PID 2268 wrote to memory of 944	2268	cmd.exe	schtasks.exe
PID 2268 wrote to memory of 944	2268	cmd.exe	schtasks.exe
PID 5116 wrote to memory of 2132	5116	pcshield.exe	RegAsm.exe
PID 5116 wrote to memory of 2132	5116	pcshield.exe	RegAsm.exe
PID 5116 wrote to memory of 2132	5116	pcshield.exe	RegAsm.exe
PID 5116 wrote to memory of 2132	5116	pcshield.exe	RegAsm.exe
PID 5116 wrote to memory of 2132	5116	pcshield.exe	RegAsm.exe
PID 5116 wrote to memory of 2132	5116	pcshield.exe	RegAsm.exe
PID 5116 wrote to memory of 2132	5116	pcshield.exe	RegAsm.exe
PID 5116 wrote to memory of 2132	5116	pcshield.exe	RegAsm.exe
PID 5116 wrote to memory of 2132	5116	pcshield.exe	RegAsm.exe
PID 5116 wrote to memory of 2132	5116	pcshield.exe	RegAsm.exe
PID 5116 wrote to memory of 2132	5116	pcshield.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\1540c36f7454d7fc450d9ba1df2d0b27.exe
"C:\Users\Admin\AppData\Local\Temp\1540c36f7454d7fc450d9ba1df2d0b27.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1600

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Local\Temp\pcshield\pcshield.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Local\Temp\pcshield\pcshield.exe'" /f
3⤵
- Creates scheduled task(s)
PID:944

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\1540c36f7454d7fc450d9ba1df2d0b27.exe" "C:\Users\Admin\AppData\Local\Temp\pcshield\pcshield.exe"
2⤵
PID:4740

C:\Users\Admin\AppData\Local\Temp\pcshield\pcshield.exe
C:\Users\Admin\AppData\Local\Temp\pcshield\pcshield.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 540
3⤵
- Program crash
PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2132 -ip 2132
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pcshield\pcshield.exe
Filesize
712KB

MD5
246c5c2e0bbbe6624990c857c82d6495

SHA1
b740b021e1fb7de634c91fc2981e13518648139b

SHA256
322a45b42194a943e889a87e423f09aacac4749fc96054bc02c936115acfd2fa

SHA512
a1fb631102e30b5bd403fedf4fd318b34e23bfb44edb48316d7504d3ec823dbfd8a3296dc464a45440f4244fe7a863c4d60231850ecbde7964a464ab188f896e

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcshield\pcshield.exe
Filesize
321KB

MD5
c626bcccfc34399a76ea390e383c3627

SHA1
62f243a0631efcc9b4d40ab4ce0c9db7a6ebd6dc

SHA256
310e06c4a3ab6d73126794dd4ec9f6a43dc9ced0112d8205c5a0d1d712386e17

SHA512
ae19b32ce9aea7dac631ec1ab3dff46b08351511db7caf481d525340f7ba2c1cefae193895dfd55d99b8d32008c4a28f596c97b4dc2f928ca825cc7b1ec6b5a5

Download Submit
memory/1600-34-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-16-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-50-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-52-0x0000000070B80000-0x0000000070BB9000-memory.dmp

Filesize
228KB

Download
memory/1600-6-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-8-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-51-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-10-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-11-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-12-0x0000000070AA0000-0x0000000070AD9000-memory.dmp

Filesize
228KB

Download
memory/1600-13-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-15-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-17-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-33-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-19-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-20-0x0000000070B80000-0x0000000070BB9000-memory.dmp

Filesize
228KB

Download
memory/1600-18-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-23-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-7-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-24-0x0000000070B80000-0x0000000070BB9000-memory.dmp

Filesize
228KB

Download
memory/1600-14-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-22-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-25-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-26-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1600-27-0x0000000070B80000-0x0000000070BB9000-memory.dmp

Filesize
228KB

Download
memory/1600-35-0x00000000755E0000-0x0000000075619000-memory.dmp

Filesize
228KB

Download
memory/2132-48-0x0000000000B50000-0x0000000000F1E000-memory.dmp

Filesize
3.8MB

Download
memory/2132-44-0x0000000000B50000-0x0000000000F1E000-memory.dmp

Filesize
3.8MB

Download
memory/2132-49-0x0000000000B50000-0x0000000000F1E000-memory.dmp

Filesize
3.8MB

Download
memory/4768-2-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/4768-30-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4768-0-0x0000000000A10000-0x0000000000E1C000-memory.dmp

Filesize
4.0MB

Download
memory/4768-28-0x00000000015D0000-0x0000000001636000-memory.dmp

Filesize
408KB

Download
memory/4768-3-0x0000000005DA0000-0x0000000006344000-memory.dmp

Filesize
5.6MB

Download
memory/4768-1-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4768-21-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4768-5-0x0000000005880000-0x000000000588A000-memory.dmp

Filesize
40KB

Download
memory/4768-4-0x0000000005890000-0x0000000005922000-memory.dmp

Filesize
584KB

Download
memory/5116-38-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/5116-53-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads