bitrat | 317b32811ef46a4dec52e650315c82b5a5f867f49e5844bb11ed4e1f5281e6d9

General

Target

37b87bb801399002ce5109fa582512de.exe
Size

2.5MB
MD5

37b87bb801399002ce5109fa582512de
SHA1

d634ba38c689efef5c72f976b88b61e5bb78989a
SHA256

317b32811ef46a4dec52e650315c82b5a5f867f49e5844bb11ed4e1f5281e6d9
SHA512

fd066e3d8dd991dd78b0efeb09ce0bd4393dc234b82038ee3a22e6b64defa75fec6d54736fb9375a7e26773eb767f90c99b70e4f9a63c379d666a72f129823fd
SSDEEP

49152:kNoHMdmCm6Ud+zPXUk7GqCefc+dA1fh85ETksqhhiKOg8efG9CDNk3:kNosdmCmN+rE/D4PdUcEgnfiKOeDNS

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.35

C2

storage.nsupdate.info:8973

Attributes

communication_password
bf771c9d082071fe80b18bb678220682
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/2004-3-0x0000000000440000-0x0000000000452000-memory.dmp	CustAttr

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2884-27-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-28-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-39-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-42-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-40-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-37-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-36-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-45-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-50-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-54-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-57-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-59-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-60-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-61-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-62-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-63-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-64-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-65-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-67-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-66-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-68-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2884-69-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

RegSvcs.exe

pid process

2884 RegSvcs.exe
2884 RegSvcs.exe
2884 RegSvcs.exe
2884 RegSvcs.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

37b87bb801399002ce5109fa582512de.exe

description pid process target process

PID 2004 set thread context of 2884 2004 37b87bb801399002ce5109fa582512de.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1128 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exe37b87bb801399002ce5109fa582512de.exe

pid process

2856 powershell.exe
324 powershell.exe
1584 powershell.exe
2004 37b87bb801399002ce5109fa582512de.exe

pid	process
2884	RegSvcs.exe
2884	RegSvcs.exe
2884	RegSvcs.exe
2884	RegSvcs.exe

description	pid	process	target process
PID 2004 set thread context of 2884	2004	37b87bb801399002ce5109fa582512de.exe	RegSvcs.exe

pid	process
1128	schtasks.exe

pid	process
2856	powershell.exe
324	powershell.exe
1584	powershell.exe
2004	37b87bb801399002ce5109fa582512de.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exe37b87bb801399002ce5109fa582512de.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	324	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	2004	37b87bb801399002ce5109fa582512de.exe
Token: SeDebugPrivilege	2884	RegSvcs.exe
Token: SeShutdownPrivilege	2884	RegSvcs.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

RegSvcs.exe

pid process

2884 RegSvcs.exe
2884 RegSvcs.exe

pid	process
2884	RegSvcs.exe
2884	RegSvcs.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

37b87bb801399002ce5109fa582512de.exe

description	pid	process	target process
PID 2004 wrote to memory of 1584	2004	37b87bb801399002ce5109fa582512de.exe	powershell.exe
PID 2004 wrote to memory of 1584	2004	37b87bb801399002ce5109fa582512de.exe	powershell.exe
PID 2004 wrote to memory of 1584	2004	37b87bb801399002ce5109fa582512de.exe	powershell.exe
PID 2004 wrote to memory of 1584	2004	37b87bb801399002ce5109fa582512de.exe	powershell.exe
PID 2004 wrote to memory of 324	2004	37b87bb801399002ce5109fa582512de.exe	powershell.exe
PID 2004 wrote to memory of 324	2004	37b87bb801399002ce5109fa582512de.exe	powershell.exe
PID 2004 wrote to memory of 324	2004	37b87bb801399002ce5109fa582512de.exe	powershell.exe
PID 2004 wrote to memory of 324	2004	37b87bb801399002ce5109fa582512de.exe	powershell.exe
PID 2004 wrote to memory of 1128	2004	37b87bb801399002ce5109fa582512de.exe	schtasks.exe
PID 2004 wrote to memory of 1128	2004	37b87bb801399002ce5109fa582512de.exe	schtasks.exe
PID 2004 wrote to memory of 1128	2004	37b87bb801399002ce5109fa582512de.exe	schtasks.exe
PID 2004 wrote to memory of 1128	2004	37b87bb801399002ce5109fa582512de.exe	schtasks.exe
PID 2004 wrote to memory of 2856	2004	37b87bb801399002ce5109fa582512de.exe	powershell.exe
PID 2004 wrote to memory of 2856	2004	37b87bb801399002ce5109fa582512de.exe	powershell.exe
PID 2004 wrote to memory of 2856	2004	37b87bb801399002ce5109fa582512de.exe	powershell.exe
PID 2004 wrote to memory of 2856	2004	37b87bb801399002ce5109fa582512de.exe	powershell.exe
PID 2004 wrote to memory of 2884	2004	37b87bb801399002ce5109fa582512de.exe	RegSvcs.exe
PID 2004 wrote to memory of 2884	2004	37b87bb801399002ce5109fa582512de.exe	RegSvcs.exe
PID 2004 wrote to memory of 2884	2004	37b87bb801399002ce5109fa582512de.exe	RegSvcs.exe
PID 2004 wrote to memory of 2884	2004	37b87bb801399002ce5109fa582512de.exe	RegSvcs.exe
PID 2004 wrote to memory of 2884	2004	37b87bb801399002ce5109fa582512de.exe	RegSvcs.exe
PID 2004 wrote to memory of 2884	2004	37b87bb801399002ce5109fa582512de.exe	RegSvcs.exe
PID 2004 wrote to memory of 2884	2004	37b87bb801399002ce5109fa582512de.exe	RegSvcs.exe
PID 2004 wrote to memory of 2884	2004	37b87bb801399002ce5109fa582512de.exe	RegSvcs.exe
PID 2004 wrote to memory of 2884	2004	37b87bb801399002ce5109fa582512de.exe	RegSvcs.exe
PID 2004 wrote to memory of 2884	2004	37b87bb801399002ce5109fa582512de.exe	RegSvcs.exe
PID 2004 wrote to memory of 2884	2004	37b87bb801399002ce5109fa582512de.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\37b87bb801399002ce5109fa582512de.exe
"C:\Users\Admin\AppData\Local\Temp\37b87bb801399002ce5109fa582512de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\37b87bb801399002ce5109fa582512de.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uSZqfqgTOxUNw.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:324

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uSZqfqgTOxUNw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6603.tmp"
2⤵
- Creates scheduled task(s)
PID:1128

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uSZqfqgTOxUNw.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6603.tmp
Filesize
1KB

MD5
fb6e4098a9569184e9bfb5d86243a9fd

SHA1
5bc4ee92fb80a29b9f8ca621df762cb1dbd0050a

SHA256
fb11acf23c0e516f713fb4fcaef84445fa78b0ee77290504f367e448236ec20b

SHA512
c50304886460e96e27ee33f0d51617b91dab7492c20181800fb29a7fdf872d59698a2f4b327ac858d8e639ce0381266922978231ab0c9250797542a4a8877ef8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
b26eeeffdf717391dafbe0e0359df19d

SHA1
995ff5ef227368ae745ac461a80cfecdadc9da34

SHA256
4a8827cd87453ca15628ac96ef090f72ddc6210f90038174519ff09ee5d4ba2a

SHA512
a8e8ca597263964d02dd815f43313e2736ffdc9207ece44b3f8a681981a83e2ec1fea5068c594fcf2ed6d76b2346a8280b981a129a29b2d77fa127ef4a5c63cd

Download Submit
memory/324-32-0x000000006FA60000-0x000000007000B000-memory.dmp

Filesize
5.7MB

Download
memory/324-38-0x0000000002480000-0x00000000024C0000-memory.dmp

Filesize
256KB

Download
memory/324-35-0x0000000002480000-0x00000000024C0000-memory.dmp

Filesize
256KB

Download
memory/324-52-0x000000006FA60000-0x000000007000B000-memory.dmp

Filesize
5.7MB

Download
memory/324-26-0x000000006FA60000-0x000000007000B000-memory.dmp

Filesize
5.7MB

Download
memory/1584-33-0x0000000000240000-0x0000000000280000-memory.dmp

Filesize
256KB

Download
memory/1584-29-0x000000006FA60000-0x000000007000B000-memory.dmp

Filesize
5.7MB

Download
memory/1584-49-0x0000000000240000-0x0000000000280000-memory.dmp

Filesize
256KB

Download
memory/1584-48-0x0000000000240000-0x0000000000280000-memory.dmp

Filesize
256KB

Download
memory/1584-20-0x000000006FA60000-0x000000007000B000-memory.dmp

Filesize
5.7MB

Download
memory/1584-51-0x000000006FA60000-0x000000007000B000-memory.dmp

Filesize
5.7MB

Download
memory/2004-5-0x0000000006D10000-0x0000000006ED6000-memory.dmp

Filesize
1.8MB

Download
memory/2004-0-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2004-6-0x0000000006FD0000-0x000000000714C000-memory.dmp

Filesize
1.5MB

Download
memory/2004-44-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2004-4-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2004-3-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/2004-2-0x0000000004F20000-0x0000000004F60000-memory.dmp

Filesize
256KB

Download
memory/2004-1-0x0000000000E00000-0x0000000001080000-memory.dmp

Filesize
2.5MB

Download
memory/2856-55-0x000000006FA60000-0x000000007000B000-memory.dmp

Filesize
5.7MB

Download
memory/2856-46-0x00000000024C0000-0x0000000002500000-memory.dmp

Filesize
256KB

Download
memory/2856-43-0x00000000024C0000-0x0000000002500000-memory.dmp

Filesize
256KB

Download
memory/2856-41-0x000000006FA60000-0x000000007000B000-memory.dmp

Filesize
5.7MB

Download
memory/2856-47-0x00000000024C0000-0x0000000002500000-memory.dmp

Filesize
256KB

Download
memory/2884-54-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-25-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-45-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-36-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-37-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-40-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-39-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-50-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-28-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-27-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-42-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2884-57-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-59-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-60-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-61-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-62-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-63-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-64-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-65-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-67-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-66-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-68-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2884-69-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads