bitrat | 418f4beab3913272a5ce86075202e67fe89a273c7840b53d0eccb0229dfea020

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1493c9c3de438c1d925f3a4af556f04.exe
Size

2.2MB
MD5

b1493c9c3de438c1d925f3a4af556f04
SHA1

16ba06f5872a5d79ad1dd835669a9d5f55cf10d2
SHA256

418f4beab3913272a5ce86075202e67fe89a273c7840b53d0eccb0229dfea020
SHA512

9556f48f59abd27cdd919fcb892de800d5291b012ebef9c4042804662f58f671fff8f700f3c22e9c6566f7994fcbd7cbadd35625faa1e17e5f72285b4359fad9
SSDEEP

24576:0KtlfLm3/4s8krM4hsJgqGMDA2Q0CDwuJZqrMNCYjef9juun4MoTq0:Hj44VTgfH2r6qfpo2

Score

10^/10

bitrat persistence trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

111.90.158.139:1234

Attributes

communication_password
9d7e1007ecf7445a02f5ed83b32ff32c
install_dir
svchost
install_file
svchost.exe
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	b1493c9c3de438c1d925f3a4af556f04.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	b1493c9c3de438c1d925f3a4af556f04.exe

Executes dropped EXE 2 IoCs

pid	Process
2000	svchost.exe
2724	AddInProcess32.exe

Loads dropped DLL 2 IoCs

pid	Process
2912	b1493c9c3de438c1d925f3a4af556f04.exe
2000	svchost.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2724-26-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-27-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-30-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-32-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-33-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-34-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-35-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-36-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-37-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-39-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-41-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-42-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-43-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-44-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-45-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-46-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-47-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-48-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-49-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-50-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2724-51-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\svchost\\svchost.exe"	AddInProcess32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe"	reg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2724	AddInProcess32.exe
2724	AddInProcess32.exe
2724	AddInProcess32.exe
2724	AddInProcess32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2000 set thread context of 2724	2000	svchost.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2912	b1493c9c3de438c1d925f3a4af556f04.exe
2912	b1493c9c3de438c1d925f3a4af556f04.exe
2912	b1493c9c3de438c1d925f3a4af556f04.exe
2000	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	b1493c9c3de438c1d925f3a4af556f04.exe
Token: SeDebugPrivilege	2000	svchost.exe
Token: SeDebugPrivilege	2724	AddInProcess32.exe
Token: SeShutdownPrivilege	2724	AddInProcess32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2724	AddInProcess32.exe
2724	AddInProcess32.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2528	2912	b1493c9c3de438c1d925f3a4af556f04.exe	28
PID 2912 wrote to memory of 2528	2912	b1493c9c3de438c1d925f3a4af556f04.exe	28
PID 2912 wrote to memory of 2528	2912	b1493c9c3de438c1d925f3a4af556f04.exe	28
PID 2912 wrote to memory of 2528	2912	b1493c9c3de438c1d925f3a4af556f04.exe	28
PID 2528 wrote to memory of 2692	2528	cmd.exe	30
PID 2528 wrote to memory of 2692	2528	cmd.exe	30
PID 2528 wrote to memory of 2692	2528	cmd.exe	30
PID 2528 wrote to memory of 2692	2528	cmd.exe	30
PID 2912 wrote to memory of 2000	2912	b1493c9c3de438c1d925f3a4af556f04.exe	33
PID 2912 wrote to memory of 2000	2912	b1493c9c3de438c1d925f3a4af556f04.exe	33
PID 2912 wrote to memory of 2000	2912	b1493c9c3de438c1d925f3a4af556f04.exe	33
PID 2912 wrote to memory of 2000	2912	b1493c9c3de438c1d925f3a4af556f04.exe	33
PID 2000 wrote to memory of 2724	2000	svchost.exe	34
PID 2000 wrote to memory of 2724	2000	svchost.exe	34
PID 2000 wrote to memory of 2724	2000	svchost.exe	34
PID 2000 wrote to memory of 2724	2000	svchost.exe	34
PID 2000 wrote to memory of 2724	2000	svchost.exe	34
PID 2000 wrote to memory of 2724	2000	svchost.exe	34
PID 2000 wrote to memory of 2724	2000	svchost.exe	34
PID 2000 wrote to memory of 2724	2000	svchost.exe	34
PID 2000 wrote to memory of 2028	2000	svchost.exe	35
PID 2000 wrote to memory of 2028	2000	svchost.exe	35
PID 2000 wrote to memory of 2028	2000	svchost.exe	35
PID 2000 wrote to memory of 2028	2000	svchost.exe	35
PID 2028 wrote to memory of 2300	2028	cmd.exe	37
PID 2028 wrote to memory of 2300	2028	cmd.exe	37
PID 2028 wrote to memory of 2300	2028	cmd.exe	37
PID 2028 wrote to memory of 2300	2028	cmd.exe	37
PID 2000 wrote to memory of 824	2000	svchost.exe	38
PID 2000 wrote to memory of 824	2000	svchost.exe	38
PID 2000 wrote to memory of 824	2000	svchost.exe	38
PID 2000 wrote to memory of 824	2000	svchost.exe	38
PID 824 wrote to memory of 1744	824	cmd.exe	40
PID 824 wrote to memory of 1744	824	cmd.exe	40
PID 824 wrote to memory of 1744	824	cmd.exe	40
PID 824 wrote to memory of 1744	824	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\b1493c9c3de438c1d925f3a4af556f04.exe
"C:\Users\Admin\AppData\Local\Temp\b1493c9c3de438c1d925f3a4af556f04.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
    3⤵
    - Adds Run key to start application
    PID:2692
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
    "C:\Users\Admin\AppData\Local\Temp\\AddInProcess32.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2724
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
      4⤵
      Adds Run key to start application
      PID:2300
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
      4⤵
      Adds Run key to start application
      PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

Filesize
41KB

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe

Filesize
2.2MB

MD5
b1493c9c3de438c1d925f3a4af556f04

SHA1
16ba06f5872a5d79ad1dd835669a9d5f55cf10d2

SHA256
418f4beab3913272a5ce86075202e67fe89a273c7840b53d0eccb0229dfea020

SHA512
9556f48f59abd27cdd919fcb892de800d5291b012ebef9c4042804662f58f671fff8f700f3c22e9c6566f7994fcbd7cbadd35625faa1e17e5f72285b4359fad9

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe

Filesize
103KB

MD5
8e7a1806e207754c612660a708326fce

SHA1
c94e384b45ef9a7cc571f114fff783aeea84a907

SHA256
e0d694d467e9e20d3e63ff52632e3fbbfcc27ce71a72f303bd88ef51bef0d09f

SHA512
27bea6464fb82a3ed0d7a5a8909736396c1550a69b0321453a085b8979ac1ab95a9e5d8f30fb0480ccd79089eaedccbb8788f48502cc6eb9dbba27c19e25fede

Download Submit
memory/2000-15-0x00000000002F0000-0x0000000000534000-memory.dmp

Filesize
2.3MB

Download
memory/2000-21-0x0000000000940000-0x0000000000952000-memory.dmp

Filesize
72KB

Download
memory/2000-20-0x00000000043E0000-0x0000000004420000-memory.dmp

Filesize
256KB

Download
memory/2000-19-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2000-17-0x00000000043E0000-0x0000000004420000-memory.dmp

Filesize
256KB

Download
memory/2000-16-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2724-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2724-34-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-51-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-50-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-49-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-48-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-47-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-46-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-24-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-26-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-27-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-45-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-30-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-32-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-33-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-44-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-35-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-36-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-37-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-39-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-41-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-42-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2724-43-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2912-7-0x0000000004FE0000-0x0000000005020000-memory.dmp

Filesize
256KB

Download
memory/2912-0-0x0000000000260000-0x00000000004A4000-memory.dmp

Filesize
2.3MB

Download
memory/2912-1-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2912-2-0x0000000004FE0000-0x0000000005020000-memory.dmp

Filesize
256KB

Download
memory/2912-3-0x00000000007F0000-0x000000000081C000-memory.dmp

Filesize
176KB

Download
memory/2912-4-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2912-18-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2912-5-0x0000000004FE0000-0x0000000005020000-memory.dmp

Filesize
256KB

Download