bitrat | 93974f2a42d247f0c551b0fd9913872c27940c0671423814c0b9a0f2021a30e5

General

Target

attachment_2137.exe
Size

6.0MB
MD5

37580d09f99717268666e091c21d344a
SHA1

0b7df2ebdf61753c183c818db71b4b1f6fd57841
SHA256

12d9848e317dcbf7dfb95649d7198fd93475f8b4cd093a252f28caeed8093001
SHA512

f2a1295003d64be1c768afbc6bd0f93ba53a39a883759952246371d9552777432193c35a702697061febb192cb365843480cc52c3dc44d90312a4e8be7e66749
SSDEEP

98304:JyQZRhelFuTw99bP/nCURx/PKnBWrmVjefsn+1:sQ7w99GURx/PKwQe

Score

10^/10

bitrat agilenet persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.35

C2

snkno.duckdns.org:43413

Attributes

communication_password
827ccb0eea8a706c4c34a16891f84e7b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	attachment_2137.exe

Executes dropped EXE 2 IoCs

pid	Process
4872	iCloud.exe
4972	AddInProcess32.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/880-6-0x0000000006000000-0x0000000006028000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\apple = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\iCloud.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4872 set thread context of 4972	4872	iCloud.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4404	4972	WerFault.exe	107

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
880	attachment_2137.exe
4872	iCloud.exe
4872	iCloud.exe
4872	iCloud.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	880	attachment_2137.exe
Token: SeDebugPrivilege	4872	iCloud.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 3808	880	attachment_2137.exe	95
PID 880 wrote to memory of 3808	880	attachment_2137.exe	95
PID 880 wrote to memory of 3808	880	attachment_2137.exe	95
PID 3808 wrote to memory of 4572	3808	cmd.exe	93
PID 3808 wrote to memory of 4572	3808	cmd.exe	93
PID 3808 wrote to memory of 4572	3808	cmd.exe	93
PID 880 wrote to memory of 4872	880	attachment_2137.exe	105
PID 880 wrote to memory of 4872	880	attachment_2137.exe	105
PID 880 wrote to memory of 4872	880	attachment_2137.exe	105
PID 4872 wrote to memory of 4972	4872	iCloud.exe	107
PID 4872 wrote to memory of 4972	4872	iCloud.exe	107
PID 4872 wrote to memory of 4972	4872	iCloud.exe	107
PID 4872 wrote to memory of 4972	4872	iCloud.exe	107
PID 4872 wrote to memory of 4972	4872	iCloud.exe	107
PID 4872 wrote to memory of 4972	4872	iCloud.exe	107
PID 4872 wrote to memory of 4972	4872	iCloud.exe	107
PID 4872 wrote to memory of 4972	4872	iCloud.exe	107
PID 4872 wrote to memory of 4972	4872	iCloud.exe	107
PID 4872 wrote to memory of 4972	4872	iCloud.exe	107
PID 4872 wrote to memory of 4972	4872	iCloud.exe	107

C:\Users\Admin\AppData\Local\Temp\attachment_2137.exe
"C:\Users\Admin\AppData\Local\Temp\attachment_2137.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "apple" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3808
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
    "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
    3⤵
    - Executes dropped EXE
    PID:4972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 188
      4⤵
      Program crash
      PID:4404

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "apple" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe"
1⤵
- Adds Run key to start application
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4972 -ip 4972
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

Filesize
27KB

MD5
2a56c451b199ad006d251c596e2fcce3

SHA1
93ed1eedb4893c33b9290b2ba29b6e5bc7fbdf65

SHA256
1dd42ade54f5b597188c41c780b91c0e5306d2df1e5957679be0ac8f038d2183

SHA512
b0d3070d2756e237b2ce20f0f7cd45c2ed2a93e95a6bebbc8099ce51de4361de7e28fe12f35dec70a3350e8a0f915934987d7c1556dc1d70fb185fa8e9de906d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe

Filesize
64KB

MD5
480134573228a16dbf9dced2cec9b365

SHA1
936c46a635eccb5616c99b9325a99834b827bba7

SHA256
e2a7f11ffefb8e2e2b5ccbe8b858d0a571d3cc71aaa04d468201924a044f269b

SHA512
8ffe35d425fa2d630203fd84a72473b9e8c8a295044e152d3f5a081d3f3f6bddd4f4c4ec56381a12afa36d484ec065471e1ae141307dc0f41a43ab3f9c443e7b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe

Filesize
19KB

MD5
087f408938994ea479e278115cc6805d

SHA1
75a0fa6383204d86db63d544ba1f2edbe27c9b12

SHA256
2b313f70264cc8bee5b91c1331a41723fa8a0c0de8a2b8f215e346f6bf90012a

SHA512
ce30362baed179109b8ad348ee2add81174c5d4ab93b9c873a2c2c351a29a81603ede3061ead1651d4136d472ea4fc622a45b70a289b4ff6934f679f6c87314d

Download Submit
memory/880-8-0x0000000007270000-0x0000000007292000-memory.dmp

Filesize
136KB

Download
memory/880-3-0x0000000005B20000-0x0000000005BB2000-memory.dmp

Filesize
584KB

Download
memory/880-6-0x0000000006000000-0x0000000006028000-memory.dmp

Filesize
160KB

Download
memory/880-1-0x0000000000A80000-0x000000000108C000-memory.dmp

Filesize
6.0MB

Download
memory/880-7-0x00000000072B0000-0x0000000007316000-memory.dmp

Filesize
408KB

Download
memory/880-9-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/880-10-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/880-11-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/880-12-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/880-5-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/880-4-0x0000000005BC0000-0x0000000005C5C000-memory.dmp

Filesize
624KB

Download
memory/880-2-0x0000000006030000-0x00000000065D4000-memory.dmp

Filesize
5.6MB

Download
memory/880-0-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/880-26-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4872-28-0x0000000005990000-0x00000000059A0000-memory.dmp

Filesize
64KB

Download
memory/4872-29-0x0000000005990000-0x00000000059A0000-memory.dmp

Filesize
64KB

Download
memory/4872-30-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4872-31-0x0000000005990000-0x00000000059A0000-memory.dmp

Filesize
64KB

Download
memory/4872-33-0x0000000006FB0000-0x0000000006FB6000-memory.dmp

Filesize
24KB

Download
memory/4872-32-0x00000000032A0000-0x00000000032B4000-memory.dmp

Filesize
80KB

Download
memory/4872-27-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4972-37-0x0000000000700000-0x0000000000ACE000-memory.dmp

Filesize
3.8MB

Download
memory/4972-41-0x0000000000700000-0x0000000000ACE000-memory.dmp

Filesize
3.8MB

Download
memory/4972-45-0x0000000000700000-0x0000000000ACE000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads