bitrat | db5d4a5090c7303616f88db08a22abc975804ae1abdef9740c208c004648255b

General

Target

024cde85d1a11c1b2e6749ec80b50fad.exe
Size

2.8MB
MD5

024cde85d1a11c1b2e6749ec80b50fad
SHA1

5f7226f27b0106f6050ce61d78e9c0fc8cfb8373
SHA256

db5d4a5090c7303616f88db08a22abc975804ae1abdef9740c208c004648255b
SHA512

5016d4eb26602300e49365186ce768026ac73927f41773883a6fc43376b622bc76a2d72d675cfa29224540cf82f8291a9ed03b0d5b762678d30b29f963ee7ccc
SSDEEP

49152:KynUHNR9PKXUm1WHyilGSvn/5Kaq1rO5n8UXRaa/B03ak8JqFJ7BHKQk6j:KyUHNjSXUmIHy8Zv/Uaq1yJqak8JqbFR

Score

10^/10

bitrat trojan upx

Malware Config

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT payload 19 IoCs

Processes:

resource	yara_rule
behavioral2/memory/744-22-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-20-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-25-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-26-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-24-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-27-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-28-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-29-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-30-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-32-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-33-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-34-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-42-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-41-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-43-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-71-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-72-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-73-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat
behavioral2/memory/744-75-0x0000000000400000-0x000000000092F000-memory.dmp	family_bitrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

024cde85d1a11c1b2e6749ec80b50fad.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	024cde85d1a11c1b2e6749ec80b50fad.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/744-15-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-19-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-22-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-20-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-25-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-26-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-24-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-27-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-21-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-28-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-29-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-30-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-17-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-32-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-33-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-34-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-42-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-41-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-43-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-71-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-72-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-73-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-75-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-78-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-79-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-81-0x0000000000400000-0x000000000092F000-memory.dmp	upx
behavioral2/memory/744-90-0x0000000000400000-0x000000000092F000-memory.dmp	upx

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

51 myexternalip.com
52 myexternalip.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
51	myexternalip.com
52	myexternalip.com

C:\Users\Admin\AppData\Local\Temp\024cde85d1a11c1b2e6749ec80b50fad.exe
"C:\Users\Admin\AppData\Local\Temp\024cde85d1a11c1b2e6749ec80b50fad.exe"
1⤵
- Checks computer location settings
PID:2808

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C start /min C:\Windows\system32\cmd.exe /C bitsfx.txt -p123
2⤵
PID:2912

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C bitsfx.txt -p123
1⤵
PID:1124

C:\Users\Admin\AppData\Local\Temp\RarSFX0\bitsfx.txt
bitsfx.txt -p123
2⤵
PID:3000

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C start /min C:\Windows\system32\cmd.exe /C xcopy "bit.txt" "C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe*" /Y
3⤵
PID:3256

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C xcopy "bit.txt" "C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe*" /Y
4⤵
PID:2100

C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe"
3⤵
PID:3152

C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.EXE
"C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.EXE"
4⤵
PID:744

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C start /min C:\Windows\system32\cmd.exe /C REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v "Microsoft InstallShield" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe" /f
3⤵
PID:3572

C:\Windows\SysWOW64\xcopy.exe
xcopy "bit.txt" "C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe*" /Y
1⤵
PID:4900

C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v "Microsoft InstallShield" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe" /f
1⤵
PID:3188

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v "Microsoft InstallShield" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe" /f
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX1\bit.txt
Filesize
476KB

MD5
3acf28b2ca3be7605915fdf1718abf8c

SHA1
655c278820cdf96295e0ec4bf8b4b02292afacd0

SHA256
21f48a90eecb93c99dd0976cfeae732759bca91278b83ad4525b79f19ca91448

SHA512
f9b09137400f4d19babff6198162d8693fe2ba295df8ede8fec6c0ccedb9da21ea21e09f303b3cf5d3327353a0f12d32acb388563842c69ba51c88a8c6ddfbd0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe
Filesize
386KB

MD5
a138a183331f1a3476d3eb7833d1a703

SHA1
63d4e01f350c298aae0e57769030eff178424414

SHA256
66d626f56f2dcaeba1027b33959409478313f38703b8e4f076dd7525fbb75ee3

SHA512
13f375ad03b402b1048862f7e35b3cb2e8e6da57f4b2b56e41e226d79c20164987b21913508fa9a7afa5ae15178ea59d850c6f04c64728bd66bf8bb68106f4d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\InstallShield\Desktop.exe
Filesize
57KB

MD5
9531b6bf9db2d6a0403e8bd9f86bc61e

SHA1
2b9e6f4feec5f58364f621f9e3e09f162d5e1677

SHA256
a5e35920425ae8e2635e69d7c3b0448e7df56cd7ea0c16c06f5ab6b9eb5506e8

SHA512
8f999e6e88fb41996024a784dde23f6beafec5f06d697ea65c265fc92e71b7cad86150c0c60abb876da0335ce435892399a2d58756f0deea2f3a35a0b1301900

Download Submit
memory/744-24-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-23-0x0000000072AE0000-0x0000000072B19000-memory.dmp

Filesize
228KB

Download
memory/744-32-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-25-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-26-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-22-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-27-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-21-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-28-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-29-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-30-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-31-0x00000000727D0000-0x0000000072809000-memory.dmp

Filesize
228KB

Download
memory/744-17-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-19-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-90-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-20-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-33-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-34-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-42-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-41-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-43-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-71-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-72-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-74-0x0000000072E90000-0x0000000072EC9000-memory.dmp

Filesize
228KB

Download
memory/744-73-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-75-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-78-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-79-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-81-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/744-15-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads