bitrat | f0c2e55ec391d428f5f79b270bc770f5c684414becd8d2c7f0c8fb78462b47bb

Analysis

max time kernel
28s
max time network
19s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-02-2024 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

STUB.exe
Size

3.8MB
MD5

08b8d6d55fa0ab4034e2080270e83fdb
SHA1

4fba6fa6251f41e381588335e7b73c77765149f9
SHA256

f0c2e55ec391d428f5f79b270bc770f5c684414becd8d2c7f0c8fb78462b47bb
SHA512

83ff113311596c16c8f6192ce7b1e03125327f225d9734074508ea9a4925e897ea6b5afbb648434082bf5d058ed442bb5993f057be407282ec20e5e6613a2beb
SSDEEP

98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/DmlwXVZ4FB:5+R/eZADUXR

Score

10^/10

bitrat persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

Cluluvsu-34807.portmap.host:34807

Attributes

communication_password
e10adc3949ba59abbe56e057f20f883e
install_dir
sdudir
install_file
sudir
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

STUB.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\sudir = "C:\\Users\\Admin\\AppData\\Local\\sdudir\\sudir"	STUB.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

STUB.exe

pid process

2256 STUB.exe
2256 STUB.exe
2256 STUB.exe
2256 STUB.exe

pid	process
2256	STUB.exe
2256	STUB.exe
2256	STUB.exe
2256	STUB.exe

NTFS ADS 2 IoCs

Processes:

STUB.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local:05-02-2024	STUB.exe
File opened for modification	C:\Users\Admin\AppData\Local:05-02-2024	STUB.exe

Suspicious behavior: RenamesItself 6 IoCs

Processes:

STUB.exe

pid process

2256 STUB.exe
2256 STUB.exe
2256 STUB.exe
2256 STUB.exe
2256 STUB.exe
2256 STUB.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

STUB.exe

description pid process

Token: SeDebugPrivilege 2256 STUB.exe
Token: SeShutdownPrivilege 2256 STUB.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

STUB.exe

pid process

2256 STUB.exe
2256 STUB.exe

pid	process
2256	STUB.exe
2256	STUB.exe
2256	STUB.exe
2256	STUB.exe
2256	STUB.exe
2256	STUB.exe

description	pid	process
Token: SeDebugPrivilege	2256	STUB.exe
Token: SeShutdownPrivilege	2256	STUB.exe

pid	process
2256	STUB.exe
2256	STUB.exe

C:\Users\Admin\AppData\Local\Temp\STUB.exe
"C:\Users\Admin\AppData\Local\Temp\STUB.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2256

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1640

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2256-0-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download