bitrat | 418f4beab3913272a5ce86075202e67fe89a273c7840b53d0eccb0229dfea020

General

Target

b1493c9c3de438c1d925f3a4af556f04.exe
Size

2.2MB
MD5

b1493c9c3de438c1d925f3a4af556f04
SHA1

16ba06f5872a5d79ad1dd835669a9d5f55cf10d2
SHA256

418f4beab3913272a5ce86075202e67fe89a273c7840b53d0eccb0229dfea020
SHA512

9556f48f59abd27cdd919fcb892de800d5291b012ebef9c4042804662f58f671fff8f700f3c22e9c6566f7994fcbd7cbadd35625faa1e17e5f72285b4359fad9
SSDEEP

24576:0KtlfLm3/4s8krM4hsJgqGMDA2Q0CDwuJZqrMNCYjef9juun4MoTq0:Hj44VTgfH2r6qfpo2

Score

10^/10

bitrat persistence trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

111.90.158.139:1234

Attributes

communication_password
9d7e1007ecf7445a02f5ed83b32ff32c
install_dir
svchost
install_file
svchost.exe
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Drops startup file 2 IoCs

Processes:

b1493c9c3de438c1d925f3a4af556f04.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	b1493c9c3de438c1d925f3a4af556f04.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	b1493c9c3de438c1d925f3a4af556f04.exe

Executes dropped EXE 2 IoCs

Processes:

svchost.exeAddInProcess32.exe

pid process

2000 svchost.exe
2724 AddInProcess32.exe
Loads dropped DLL 2 IoCs

Processes:

b1493c9c3de438c1d925f3a4af556f04.exesvchost.exe

pid process

2912 b1493c9c3de438c1d925f3a4af556f04.exe
2000 svchost.exe

pid	process
2000	svchost.exe
2724	AddInProcess32.exe

pid	process
2912	b1493c9c3de438c1d925f3a4af556f04.exe
2000	svchost.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2724-26-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-27-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-30-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-32-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-33-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-34-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-35-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-36-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-37-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-39-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-41-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-42-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-43-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-44-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-45-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-46-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-47-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-48-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-49-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-50-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-51-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exeAddInProcess32.exereg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\svchost\\svchost.exe"	AddInProcess32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe"	reg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

AddInProcess32.exe

pid process

2724 AddInProcess32.exe
2724 AddInProcess32.exe
2724 AddInProcess32.exe
2724 AddInProcess32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 2000 set thread context of 2724 2000 svchost.exe AddInProcess32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b1493c9c3de438c1d925f3a4af556f04.exesvchost.exe

pid process

2912 b1493c9c3de438c1d925f3a4af556f04.exe
2912 b1493c9c3de438c1d925f3a4af556f04.exe
2912 b1493c9c3de438c1d925f3a4af556f04.exe
2000 svchost.exe

pid	process
2724	AddInProcess32.exe
2724	AddInProcess32.exe
2724	AddInProcess32.exe
2724	AddInProcess32.exe

description	pid	process	target process
PID 2000 set thread context of 2724	2000	svchost.exe	AddInProcess32.exe

pid	process
2912	b1493c9c3de438c1d925f3a4af556f04.exe
2912	b1493c9c3de438c1d925f3a4af556f04.exe
2912	b1493c9c3de438c1d925f3a4af556f04.exe
2000	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

b1493c9c3de438c1d925f3a4af556f04.exesvchost.exeAddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	2912	b1493c9c3de438c1d925f3a4af556f04.exe
Token: SeDebugPrivilege	2000	svchost.exe
Token: SeDebugPrivilege	2724	AddInProcess32.exe
Token: SeShutdownPrivilege	2724	AddInProcess32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AddInProcess32.exe

pid process

2724 AddInProcess32.exe
2724 AddInProcess32.exe

pid	process
2724	AddInProcess32.exe
2724	AddInProcess32.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

b1493c9c3de438c1d925f3a4af556f04.execmd.exesvchost.execmd.execmd.exe

description	pid	process	target process
PID 2912 wrote to memory of 2528	2912	b1493c9c3de438c1d925f3a4af556f04.exe	cmd.exe
PID 2912 wrote to memory of 2528	2912	b1493c9c3de438c1d925f3a4af556f04.exe	cmd.exe
PID 2912 wrote to memory of 2528	2912	b1493c9c3de438c1d925f3a4af556f04.exe	cmd.exe
PID 2912 wrote to memory of 2528	2912	b1493c9c3de438c1d925f3a4af556f04.exe	cmd.exe
PID 2528 wrote to memory of 2692	2528	cmd.exe	reg.exe
PID 2528 wrote to memory of 2692	2528	cmd.exe	reg.exe
PID 2528 wrote to memory of 2692	2528	cmd.exe	reg.exe
PID 2528 wrote to memory of 2692	2528	cmd.exe	reg.exe
PID 2912 wrote to memory of 2000	2912	b1493c9c3de438c1d925f3a4af556f04.exe	svchost.exe
PID 2912 wrote to memory of 2000	2912	b1493c9c3de438c1d925f3a4af556f04.exe	svchost.exe
PID 2912 wrote to memory of 2000	2912	b1493c9c3de438c1d925f3a4af556f04.exe	svchost.exe
PID 2912 wrote to memory of 2000	2912	b1493c9c3de438c1d925f3a4af556f04.exe	svchost.exe
PID 2000 wrote to memory of 2724	2000	svchost.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2724	2000	svchost.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2724	2000	svchost.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2724	2000	svchost.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2724	2000	svchost.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2724	2000	svchost.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2724	2000	svchost.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2724	2000	svchost.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2028	2000	svchost.exe	cmd.exe
PID 2000 wrote to memory of 2028	2000	svchost.exe	cmd.exe
PID 2000 wrote to memory of 2028	2000	svchost.exe	cmd.exe
PID 2000 wrote to memory of 2028	2000	svchost.exe	cmd.exe
PID 2028 wrote to memory of 2300	2028	cmd.exe	reg.exe
PID 2028 wrote to memory of 2300	2028	cmd.exe	reg.exe
PID 2028 wrote to memory of 2300	2028	cmd.exe	reg.exe
PID 2028 wrote to memory of 2300	2028	cmd.exe	reg.exe
PID 2000 wrote to memory of 824	2000	svchost.exe	cmd.exe
PID 2000 wrote to memory of 824	2000	svchost.exe	cmd.exe
PID 2000 wrote to memory of 824	2000	svchost.exe	cmd.exe
PID 2000 wrote to memory of 824	2000	svchost.exe	cmd.exe
PID 824 wrote to memory of 1744	824	cmd.exe	reg.exe
PID 824 wrote to memory of 1744	824	cmd.exe	reg.exe
PID 824 wrote to memory of 1744	824	cmd.exe	reg.exe
PID 824 wrote to memory of 1744	824	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\b1493c9c3de438c1d925f3a4af556f04.exe
"C:\Users\Admin\AppData\Local\Temp\b1493c9c3de438c1d925f3a4af556f04.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2528

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
3⤵
- Adds Run key to start application
PID:2692

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
"C:\Users\Admin\AppData\Local\Temp\\AddInProcess32.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2724

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
4⤵
- Adds Run key to start application
PID:2300

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:824

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
4⤵
- Adds Run key to start application
PID:1744

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
Filesize
41KB

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
Filesize
2.2MB

MD5
b1493c9c3de438c1d925f3a4af556f04

SHA1
16ba06f5872a5d79ad1dd835669a9d5f55cf10d2

SHA256
418f4beab3913272a5ce86075202e67fe89a273c7840b53d0eccb0229dfea020

SHA512
9556f48f59abd27cdd919fcb892de800d5291b012ebef9c4042804662f58f671fff8f700f3c22e9c6566f7994fcbd7cbadd35625faa1e17e5f72285b4359fad9

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
Filesize
103KB

MD5
8e7a1806e207754c612660a708326fce

SHA1
c94e384b45ef9a7cc571f114fff783aeea84a907

SHA256
e0d694d467e9e20d3e63ff52632e3fbbfcc27ce71a72f303bd88ef51bef0d09f

SHA512
27bea6464fb82a3ed0d7a5a8909736396c1550a69b0321453a085b8979ac1ab95a9e5d8f30fb0480ccd79089eaedccbb8788f48502cc6eb9dbba27c19e25fede

Download Submit
memory/2000-15-0x00000000002F0000-0x0000000000534000-memory.dmp

Filesize
2.3MB

Download
memory/2000-21-0x0000000000940000-0x0000000000952000-memory.dmp

Filesize
72KB

Download
memory/2000-20-0x00000000043E0000-0x0000000004420000-memory.dmp

Filesize
256KB

Download
memory/2000-19-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2000-17-0x00000000043E0000-0x0000000004420000-memory.dmp

Filesize
256KB

Download
memory/2000-16-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2724-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2724-34-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-51-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-50-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-49-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-48-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-47-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-46-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-24-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-26-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-27-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-45-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-30-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-32-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-33-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-44-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-35-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-36-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-37-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-39-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-41-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-42-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-43-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2912-7-0x0000000004FE0000-0x0000000005020000-memory.dmp

Filesize
256KB

Download
memory/2912-0-0x0000000000260000-0x00000000004A4000-memory.dmp

Filesize
2.3MB

Download
memory/2912-1-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2912-2-0x0000000004FE0000-0x0000000005020000-memory.dmp

Filesize
256KB

Download
memory/2912-3-0x00000000007F0000-0x000000000081C000-memory.dmp

Filesize
176KB

Download
memory/2912-4-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2912-18-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2912-5-0x0000000004FE0000-0x0000000005020000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads