bitrat | 656399e157ed4116fd056b5e4889c25773d62c4862ccdf9646a3c27884d01576

General

Target

Shell.exe
Size

300.0MB
MD5

ee792a047fb2febbdadee7d476c96fc8
SHA1

ae71082d2321633e466489d37f29bfcec0913c8f
SHA256

d7d98d8f0c584f85bf88ba9d1b309cd92bdc35f2786decf7ee8adae1d5904f61
SHA512

6be6d06d64b949332f53f6411fd865a1c2832f57fdcce47e2afe1f8c78fa20fc248d3c950ee976a42969c590087fc64d7c2ebcc1d644eb40bc8948a7efcc6f28
SSDEEP

49152:WCbXXLwkHUqmLMe6TOh3ElWQKBUDwIx2Sfr5jIiMjt2:WmrwkH2Me6KmWQKBddSH

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

doctorsbit.duckdns.org:4012

Attributes

communication_password
827ccb0eea8a706c4c34a16891f84e7b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Executes dropped EXE 1 IoCs

Processes:

Shell.exe

pid process

3048 Shell.exe

pid	process
3048	Shell.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/768-7-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-9-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-12-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-14-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-16-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-17-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-19-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-18-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-13-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-21-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-23-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-24-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-27-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-25-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-28-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-29-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-34-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-37-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/768-38-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

RegAsm.exe

pid process

768 RegAsm.exe
768 RegAsm.exe
768 RegAsm.exe
768 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Shell.exe

description pid process target process

PID 2616 set thread context of 768 2616 Shell.exe RegAsm.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1280 schtasks.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Shell.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 2616 Shell.exe
Token: SeDebugPrivilege 768 RegAsm.exe
Token: SeShutdownPrivilege 768 RegAsm.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

RegAsm.exe

pid process

768 RegAsm.exe
768 RegAsm.exe

pid	process
768	RegAsm.exe
768	RegAsm.exe
768	RegAsm.exe
768	RegAsm.exe

description	pid	process	target process
PID 2616 set thread context of 768	2616	Shell.exe	RegAsm.exe

pid	process
1280	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2616	Shell.exe
Token: SeDebugPrivilege	768	RegAsm.exe
Token: SeShutdownPrivilege	768	RegAsm.exe

pid	process
768	RegAsm.exe
768	RegAsm.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

Shell.execmd.exetaskeng.exe

description	pid	process	target process
PID 2616 wrote to memory of 768	2616	Shell.exe	RegAsm.exe
PID 2616 wrote to memory of 768	2616	Shell.exe	RegAsm.exe
PID 2616 wrote to memory of 768	2616	Shell.exe	RegAsm.exe
PID 2616 wrote to memory of 768	2616	Shell.exe	RegAsm.exe
PID 2616 wrote to memory of 768	2616	Shell.exe	RegAsm.exe
PID 2616 wrote to memory of 768	2616	Shell.exe	RegAsm.exe
PID 2616 wrote to memory of 768	2616	Shell.exe	RegAsm.exe
PID 2616 wrote to memory of 768	2616	Shell.exe	RegAsm.exe
PID 2616 wrote to memory of 768	2616	Shell.exe	RegAsm.exe
PID 2616 wrote to memory of 768	2616	Shell.exe	RegAsm.exe
PID 2616 wrote to memory of 768	2616	Shell.exe	RegAsm.exe
PID 2616 wrote to memory of 388	2616	Shell.exe	cmd.exe
PID 2616 wrote to memory of 388	2616	Shell.exe	cmd.exe
PID 2616 wrote to memory of 388	2616	Shell.exe	cmd.exe
PID 2616 wrote to memory of 388	2616	Shell.exe	cmd.exe
PID 2616 wrote to memory of 2560	2616	Shell.exe	cmd.exe
PID 2616 wrote to memory of 2560	2616	Shell.exe	cmd.exe
PID 2616 wrote to memory of 2560	2616	Shell.exe	cmd.exe
PID 2616 wrote to memory of 2560	2616	Shell.exe	cmd.exe
PID 388 wrote to memory of 1280	388	cmd.exe	schtasks.exe
PID 388 wrote to memory of 1280	388	cmd.exe	schtasks.exe
PID 388 wrote to memory of 1280	388	cmd.exe	schtasks.exe
PID 388 wrote to memory of 1280	388	cmd.exe	schtasks.exe
PID 1736 wrote to memory of 3048	1736	taskeng.exe	Shell.exe
PID 1736 wrote to memory of 3048	1736	taskeng.exe	Shell.exe
PID 1736 wrote to memory of 3048	1736	taskeng.exe	Shell.exe
PID 1736 wrote to memory of 3048	1736	taskeng.exe	Shell.exe

C:\Users\Admin\AppData\Local\Temp\Shell.exe
"C:\Users\Admin\AppData\Local\Temp\Shell.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:768

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\Shell.exe" "C:\Users\Admin\AppData\Roaming\Shell\Shell.exe"
2⤵
PID:2560

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafnias" /tr "'C:\Users\Admin\AppData\Roaming\Shell\Shell.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:388

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafnias" /tr "'C:\Users\Admin\AppData\Roaming\Shell\Shell.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1280

C:\Windows\system32\taskeng.exe
taskeng.exe {049B69A2-FEE3-49AD-B6D3-A225AAF514E7} S-1-5-21-2444714103-3190537498-3629098939-1000:DJLAPDMX\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Users\Admin\AppData\Roaming\Shell\Shell.exe
C:\Users\Admin\AppData\Roaming\Shell\Shell.exe
2⤵
- Executes dropped EXE
PID:3048

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Shell\Shell.exe
Filesize
274KB

MD5
03b8920b21cbe7d7505447ed73c1b5bb

SHA1
8194c5432bdebf675acb337e72be48b29116bfa0

SHA256
de68b9ebf56f96430a3ba01a9a5edc14a6aad27b716e552c4d8a698900822d23

SHA512
1b7221eb8e37e32125ae52cbafad64d738a536df5dbbde6b809d8a85a38a5301daed2429a8ef7890bd21c71eaac6aa8326e0a9af1eff633345963869685da633

Download Submit
C:\Users\Admin\AppData\Roaming\Shell\Shell.exe
Filesize
414KB

MD5
d5ec04fa6ea5eb762ec1f1623c35e85c

SHA1
8b72e5196981852439a1a8bd745f5830fddcc110

SHA256
53def6685729ca19a07f4650b7b5e7fad2679c28a43b6cf3623cbb35bf4f0bec

SHA512
39319fae4cf45b98b7fb303cc158c4a5b30509ae86fb220cebbf901096ed8d3500d8dffeb502642364b97f9ee9e791c45870a6a996510e74d0c7cbb82e65d20a

Download Submit
memory/768-9-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-19-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-23-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-5-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-7-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/768-21-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-12-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-14-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-16-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-17-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-34-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-18-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-13-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-38-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-37-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-24-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-27-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-25-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-28-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/768-29-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2616-4-0x0000000005160000-0x00000000051A0000-memory.dmp

Filesize
256KB

Download
memory/2616-1-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download
memory/2616-2-0x0000000005160000-0x00000000051A0000-memory.dmp

Filesize
256KB

Download
memory/2616-3-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download
memory/2616-0-0x0000000000110000-0x00000000002D2000-memory.dmp

Filesize
1.8MB

Download
memory/3048-33-0x0000000000AA0000-0x0000000000C62000-memory.dmp

Filesize
1.8MB

Download
memory/3048-32-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download
memory/3048-35-0x0000000004910000-0x0000000004950000-memory.dmp

Filesize
256KB

Download
memory/3048-36-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads