bitrat | 6e82176449396ea6b244923e666e2147d5f0d5a64b969e2cbbbe983012f5ac90

General

Target

9273fd041c614dcc2258b7e77b783985.exe
Size

1.5MB
MD5

9273fd041c614dcc2258b7e77b783985
SHA1

2f9b8bda7e6e348e444af9b06ec25f190d787476
SHA256

6e82176449396ea6b244923e666e2147d5f0d5a64b969e2cbbbe983012f5ac90
SHA512

eb0f330806a54d441cee1bfc30fe41cbf7c45ef7e3bc019c66fb7437eeb26ce005326ae68bfe3cac10bc6aef5e8958722dea027845747cf6c9f42ac75b4c69ad
SSDEEP

24576:IyWIZgw76clTM6eX6yR3AlO6Qz1dWCvObbE179BxOfpeICljWmNvOC+QElbya1vD:gIyMi6eXf3AXQaCO47XO4bjWRQElnlD

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

45.137.22.58:1780

Attributes

communication_password
81dc9bdb52d04dc20036dbd8313ed055
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2460-2-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-5-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-3-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-7-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-6-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-8-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-9-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-12-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-14-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-15-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-13-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-11-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-16-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-18-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-19-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-20-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-24-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-25-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-26-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-29-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-30-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-31-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-35-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-36-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2460-37-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

9273fd041c614dcc2258b7e77b783985.exe

pid	process
2460	9273fd041c614dcc2258b7e77b783985.exe
2460	9273fd041c614dcc2258b7e77b783985.exe
2460	9273fd041c614dcc2258b7e77b783985.exe
2460	9273fd041c614dcc2258b7e77b783985.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9273fd041c614dcc2258b7e77b783985.exe

description pid process target process

PID 1572 set thread context of 2460 1572 9273fd041c614dcc2258b7e77b783985.exe 9273fd041c614dcc2258b7e77b783985.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

9273fd041c614dcc2258b7e77b783985.exe

pid process

1572 9273fd041c614dcc2258b7e77b783985.exe

description	pid	process	target process
PID 1572 set thread context of 2460	1572	9273fd041c614dcc2258b7e77b783985.exe	9273fd041c614dcc2258b7e77b783985.exe

pid	process
1572	9273fd041c614dcc2258b7e77b783985.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

9273fd041c614dcc2258b7e77b783985.exe

description	pid	process
Token: SeDebugPrivilege	2460	9273fd041c614dcc2258b7e77b783985.exe
Token: SeShutdownPrivilege	2460	9273fd041c614dcc2258b7e77b783985.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

9273fd041c614dcc2258b7e77b783985.exe

pid process

2460 9273fd041c614dcc2258b7e77b783985.exe
2460 9273fd041c614dcc2258b7e77b783985.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

9273fd041c614dcc2258b7e77b783985.exe

description	pid	process	target process
PID 1572 wrote to memory of 2460	1572	9273fd041c614dcc2258b7e77b783985.exe	9273fd041c614dcc2258b7e77b783985.exe
PID 1572 wrote to memory of 2460	1572	9273fd041c614dcc2258b7e77b783985.exe	9273fd041c614dcc2258b7e77b783985.exe
PID 1572 wrote to memory of 2460	1572	9273fd041c614dcc2258b7e77b783985.exe	9273fd041c614dcc2258b7e77b783985.exe
PID 1572 wrote to memory of 2460	1572	9273fd041c614dcc2258b7e77b783985.exe	9273fd041c614dcc2258b7e77b783985.exe
PID 1572 wrote to memory of 2460	1572	9273fd041c614dcc2258b7e77b783985.exe	9273fd041c614dcc2258b7e77b783985.exe

C:\Users\Admin\AppData\Local\Temp\9273fd041c614dcc2258b7e77b783985.exe
"C:\Users\Admin\AppData\Local\Temp\9273fd041c614dcc2258b7e77b783985.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Users\Admin\AppData\Local\Temp\9273fd041c614dcc2258b7e77b783985.exe
  "C:\Users\Admin\AppData\Local\Temp\9273fd041c614dcc2258b7e77b783985.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-4-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1572-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/1572-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2460-11-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-18-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-3-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-7-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-6-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-8-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-9-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-12-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-14-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-15-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-13-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-2-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-16-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-5-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-19-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-20-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-24-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-25-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-26-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-29-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-30-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-31-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-35-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-36-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2460-37-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads