bitrat | 93974f2a42d247f0c551b0fd9913872c27940c0671423814c0b9a0f2021a30e5

General

Target

attachment_2137.exe
Size

6.0MB
MD5

37580d09f99717268666e091c21d344a
SHA1

0b7df2ebdf61753c183c818db71b4b1f6fd57841
SHA256

12d9848e317dcbf7dfb95649d7198fd93475f8b4cd093a252f28caeed8093001
SHA512

f2a1295003d64be1c768afbc6bd0f93ba53a39a883759952246371d9552777432193c35a702697061febb192cb365843480cc52c3dc44d90312a4e8be7e66749
SSDEEP

98304:JyQZRhelFuTw99bP/nCURx/PKnBWrmVjefsn+1:sQ7w99GURx/PKwQe

Score

10^/10

bitrat agilenet persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.35

C2

snkno.duckdns.org:43413

Attributes

communication_password
827ccb0eea8a706c4c34a16891f84e7b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

attachment_2137.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	attachment_2137.exe

Executes dropped EXE 2 IoCs

Processes:

iCloud.exeAddInProcess32.exe

pid process

4872 iCloud.exe
4972 AddInProcess32.exe

pid	process
4872	iCloud.exe
4972	AddInProcess32.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/880-6-0x0000000006000000-0x0000000006028000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\apple = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\iCloud.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

iCloud.exe

description pid process target process

PID 4872 set thread context of 4972 4872 iCloud.exe AddInProcess32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4404 4972 WerFault.exe AddInProcess32.exe

description	pid	process	target process
PID 4872 set thread context of 4972	4872	iCloud.exe	AddInProcess32.exe

pid	pid_target	process	target process
4404	4972	WerFault.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

attachment_2137.exeiCloud.exe

pid	process
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
4872	iCloud.exe
4872	iCloud.exe
4872	iCloud.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

attachment_2137.exeiCloud.exe

description pid process

Token: SeDebugPrivilege 880 attachment_2137.exe
Token: SeDebugPrivilege 4872 iCloud.exe

description	pid	process
Token: SeDebugPrivilege	880	attachment_2137.exe
Token: SeDebugPrivilege	4872	iCloud.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

attachment_2137.execmd.exeiCloud.exe

description	pid	process	target process
PID 880 wrote to memory of 3808	880	attachment_2137.exe	cmd.exe
PID 880 wrote to memory of 3808	880	attachment_2137.exe	cmd.exe
PID 880 wrote to memory of 3808	880	attachment_2137.exe	cmd.exe
PID 3808 wrote to memory of 4572	3808	cmd.exe	reg.exe
PID 3808 wrote to memory of 4572	3808	cmd.exe	reg.exe
PID 3808 wrote to memory of 4572	3808	cmd.exe	reg.exe
PID 880 wrote to memory of 4872	880	attachment_2137.exe	iCloud.exe
PID 880 wrote to memory of 4872	880	attachment_2137.exe	iCloud.exe
PID 880 wrote to memory of 4872	880	attachment_2137.exe	iCloud.exe
PID 4872 wrote to memory of 4972	4872	iCloud.exe	AddInProcess32.exe
PID 4872 wrote to memory of 4972	4872	iCloud.exe	AddInProcess32.exe
PID 4872 wrote to memory of 4972	4872	iCloud.exe	AddInProcess32.exe
PID 4872 wrote to memory of 4972	4872	iCloud.exe	AddInProcess32.exe
PID 4872 wrote to memory of 4972	4872	iCloud.exe	AddInProcess32.exe
PID 4872 wrote to memory of 4972	4872	iCloud.exe	AddInProcess32.exe
PID 4872 wrote to memory of 4972	4872	iCloud.exe	AddInProcess32.exe
PID 4872 wrote to memory of 4972	4872	iCloud.exe	AddInProcess32.exe
PID 4872 wrote to memory of 4972	4872	iCloud.exe	AddInProcess32.exe
PID 4872 wrote to memory of 4972	4872	iCloud.exe	AddInProcess32.exe
PID 4872 wrote to memory of 4972	4872	iCloud.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\attachment_2137.exe
"C:\Users\Admin\AppData\Local\Temp\attachment_2137.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "apple" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3808

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
3⤵
- Executes dropped EXE
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 188
4⤵
- Program crash
PID:4404

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "apple" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe"
1⤵
- Adds Run key to start application
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4972 -ip 4972
1⤵
PID:5064

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
Filesize
27KB

MD5
2a56c451b199ad006d251c596e2fcce3

SHA1
93ed1eedb4893c33b9290b2ba29b6e5bc7fbdf65

SHA256
1dd42ade54f5b597188c41c780b91c0e5306d2df1e5957679be0ac8f038d2183

SHA512
b0d3070d2756e237b2ce20f0f7cd45c2ed2a93e95a6bebbc8099ce51de4361de7e28fe12f35dec70a3350e8a0f915934987d7c1556dc1d70fb185fa8e9de906d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe
Filesize
64KB

MD5
480134573228a16dbf9dced2cec9b365

SHA1
936c46a635eccb5616c99b9325a99834b827bba7

SHA256
e2a7f11ffefb8e2e2b5ccbe8b858d0a571d3cc71aaa04d468201924a044f269b

SHA512
8ffe35d425fa2d630203fd84a72473b9e8c8a295044e152d3f5a081d3f3f6bddd4f4c4ec56381a12afa36d484ec065471e1ae141307dc0f41a43ab3f9c443e7b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe
Filesize
19KB

MD5
087f408938994ea479e278115cc6805d

SHA1
75a0fa6383204d86db63d544ba1f2edbe27c9b12

SHA256
2b313f70264cc8bee5b91c1331a41723fa8a0c0de8a2b8f215e346f6bf90012a

SHA512
ce30362baed179109b8ad348ee2add81174c5d4ab93b9c873a2c2c351a29a81603ede3061ead1651d4136d472ea4fc622a45b70a289b4ff6934f679f6c87314d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/880-8-0x0000000007270000-0x0000000007292000-memory.dmp

Filesize
136KB

Download
memory/880-3-0x0000000005B20000-0x0000000005BB2000-memory.dmp

Filesize
584KB

Download
memory/880-6-0x0000000006000000-0x0000000006028000-memory.dmp

Filesize
160KB

Download
memory/880-1-0x0000000000A80000-0x000000000108C000-memory.dmp

Filesize
6.0MB

Download
memory/880-7-0x00000000072B0000-0x0000000007316000-memory.dmp

Filesize
408KB

Download
memory/880-9-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/880-10-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/880-11-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/880-12-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/880-5-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/880-4-0x0000000005BC0000-0x0000000005C5C000-memory.dmp

Filesize
624KB

Download
memory/880-2-0x0000000006030000-0x00000000065D4000-memory.dmp

Filesize
5.6MB

Download
memory/880-0-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/880-26-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4872-28-0x0000000005990000-0x00000000059A0000-memory.dmp

Filesize
64KB

Download
memory/4872-29-0x0000000005990000-0x00000000059A0000-memory.dmp

Filesize
64KB

Download
memory/4872-30-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4872-31-0x0000000005990000-0x00000000059A0000-memory.dmp

Filesize
64KB

Download
memory/4872-33-0x0000000006FB0000-0x0000000006FB6000-memory.dmp

Filesize
24KB

Download
memory/4872-32-0x00000000032A0000-0x00000000032B4000-memory.dmp

Filesize
80KB

Download
memory/4872-27-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4972-37-0x0000000000700000-0x0000000000ACE000-memory.dmp

Filesize
3.8MB

Download
memory/4972-41-0x0000000000700000-0x0000000000ACE000-memory.dmp

Filesize
3.8MB

Download
memory/4972-45-0x0000000000700000-0x0000000000ACE000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads