bitrat | 49568dbced141895672057dc8244ce926ba027f7d04915a3a8504584f56b2c87

General

Target

b4a26290880d3fb80df39f433ebb0490.exe
Size

2.6MB
MD5

b4a26290880d3fb80df39f433ebb0490
SHA1

68e61782384bac82a8b2fbbac8958a1a5dd3fe5d
SHA256

49568dbced141895672057dc8244ce926ba027f7d04915a3a8504584f56b2c87
SHA512

96438799bcf1a79f992ddd11ecedb7101a0c816b1eff1db78f2c1b48239a110a08860a1ff0f36aad883332cbb3ff690a842478dd4dffb5a94f35082404ba2182
SSDEEP

49152:YCqoHMDzSvPB+6y3im0rc56ErvHHxjLH1yzJo9pPHq8jhWEgTi:YLosavPB9Frc56EjHxjLH1GipPN8Er

Score

10^/10

bitrat evasion trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.35

C2

storage.nsupdate.info:8973

Attributes

communication_password
bf771c9d082071fe80b18bb678220682
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/1612-3-0x0000000000390000-0x00000000003A2000-memory.dmp	CustAttr

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

b4a26290880d3fb80df39f433ebb0490.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions b4a26290880d3fb80df39f433ebb0490.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

b4a26290880d3fb80df39f433ebb0490.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools b4a26290880d3fb80df39f433ebb0490.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	b4a26290880d3fb80df39f433ebb0490.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	b4a26290880d3fb80df39f433ebb0490.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b4a26290880d3fb80df39f433ebb0490.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b4a26290880d3fb80df39f433ebb0490.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b4a26290880d3fb80df39f433ebb0490.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2412-40-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-42-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-44-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-45-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-46-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-50-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-49-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-54-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-55-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-56-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-57-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-58-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-60-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-59-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-61-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-63-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-62-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-64-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-65-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-66-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-67-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-68-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-69-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-70-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-72-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-71-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-73-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-74-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-75-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2412-76-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

b4a26290880d3fb80df39f433ebb0490.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	b4a26290880d3fb80df39f433ebb0490.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	b4a26290880d3fb80df39f433ebb0490.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

MSBuild.exe

pid process

2412 MSBuild.exe
2412 MSBuild.exe
2412 MSBuild.exe
2412 MSBuild.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

b4a26290880d3fb80df39f433ebb0490.exe

description pid process target process

PID 1612 set thread context of 2412 1612 b4a26290880d3fb80df39f433ebb0490.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1032 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2404 powershell.exe
2560 powershell.exe
1868 powershell.exe

pid	process
2412	MSBuild.exe
2412	MSBuild.exe
2412	MSBuild.exe
2412	MSBuild.exe

description	pid	process	target process
PID 1612 set thread context of 2412	1612	b4a26290880d3fb80df39f433ebb0490.exe	MSBuild.exe

pid	process
1032	schtasks.exe

pid	process
2404	powershell.exe
2560	powershell.exe
1868	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exeMSBuild.exe

description	pid	process
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	2412	MSBuild.exe
Token: SeShutdownPrivilege	2412	MSBuild.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

MSBuild.exe

pid process

2412 MSBuild.exe
2412 MSBuild.exe

pid	process
2412	MSBuild.exe
2412	MSBuild.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

b4a26290880d3fb80df39f433ebb0490.exe

description	pid	process	target process
PID 1612 wrote to memory of 2560	1612	b4a26290880d3fb80df39f433ebb0490.exe	powershell.exe
PID 1612 wrote to memory of 2560	1612	b4a26290880d3fb80df39f433ebb0490.exe	powershell.exe
PID 1612 wrote to memory of 2560	1612	b4a26290880d3fb80df39f433ebb0490.exe	powershell.exe
PID 1612 wrote to memory of 2560	1612	b4a26290880d3fb80df39f433ebb0490.exe	powershell.exe
PID 1612 wrote to memory of 2404	1612	b4a26290880d3fb80df39f433ebb0490.exe	powershell.exe
PID 1612 wrote to memory of 2404	1612	b4a26290880d3fb80df39f433ebb0490.exe	powershell.exe
PID 1612 wrote to memory of 2404	1612	b4a26290880d3fb80df39f433ebb0490.exe	powershell.exe
PID 1612 wrote to memory of 2404	1612	b4a26290880d3fb80df39f433ebb0490.exe	powershell.exe
PID 1612 wrote to memory of 1032	1612	b4a26290880d3fb80df39f433ebb0490.exe	schtasks.exe
PID 1612 wrote to memory of 1032	1612	b4a26290880d3fb80df39f433ebb0490.exe	schtasks.exe
PID 1612 wrote to memory of 1032	1612	b4a26290880d3fb80df39f433ebb0490.exe	schtasks.exe
PID 1612 wrote to memory of 1032	1612	b4a26290880d3fb80df39f433ebb0490.exe	schtasks.exe
PID 1612 wrote to memory of 1868	1612	b4a26290880d3fb80df39f433ebb0490.exe	powershell.exe
PID 1612 wrote to memory of 1868	1612	b4a26290880d3fb80df39f433ebb0490.exe	powershell.exe
PID 1612 wrote to memory of 1868	1612	b4a26290880d3fb80df39f433ebb0490.exe	powershell.exe
PID 1612 wrote to memory of 1868	1612	b4a26290880d3fb80df39f433ebb0490.exe	powershell.exe
PID 1612 wrote to memory of 2412	1612	b4a26290880d3fb80df39f433ebb0490.exe	MSBuild.exe
PID 1612 wrote to memory of 2412	1612	b4a26290880d3fb80df39f433ebb0490.exe	MSBuild.exe
PID 1612 wrote to memory of 2412	1612	b4a26290880d3fb80df39f433ebb0490.exe	MSBuild.exe
PID 1612 wrote to memory of 2412	1612	b4a26290880d3fb80df39f433ebb0490.exe	MSBuild.exe
PID 1612 wrote to memory of 2412	1612	b4a26290880d3fb80df39f433ebb0490.exe	MSBuild.exe
PID 1612 wrote to memory of 2412	1612	b4a26290880d3fb80df39f433ebb0490.exe	MSBuild.exe
PID 1612 wrote to memory of 2412	1612	b4a26290880d3fb80df39f433ebb0490.exe	MSBuild.exe
PID 1612 wrote to memory of 2412	1612	b4a26290880d3fb80df39f433ebb0490.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\b4a26290880d3fb80df39f433ebb0490.exe
"C:\Users\Admin\AppData\Local\Temp\b4a26290880d3fb80df39f433ebb0490.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b4a26290880d3fb80df39f433ebb0490.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QhNsxxGtGmp.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QhNsxxGtGmp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3572.tmp"
2⤵
- Creates scheduled task(s)
PID:1032

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QhNsxxGtGmp.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2412

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3572.tmp
Filesize
1KB

MD5
96b11c41c29802d9abe24ada47cd36a0

SHA1
366bb5841c7341537920d132526f2169a0ac35d1

SHA256
1edab1d3f1508493c07d9624ccd2e941cac5926ae45e9f2669be7ccfd35f00b5

SHA512
2c75a983e64882825c5a441801fed2f2c1ff69af89390e8015a58e8a17e571ccc47e173c2637f7cf9292a1bb4573f85b678e5328da1e1663f5700a4f96fe77aa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
f476c3fe793681cc3f3b36cea0dfc7b6

SHA1
49f5ecaa2d3d077fc4076f705f53edf4c8eb800e

SHA256
ac02857c85c98777cd30ac6d228723169d694bbbb1ae4ae412aeabe6eb981b51

SHA512
e8f179f14adb5a93c4a6bac81109618e61a793e61d5c042d9f82dbb83c2e9223344b9c051b5fc337d27ee53a99ceea2b64eff5b153b2656b4cdb295629fb1eb8

Download Submit
memory/1612-1-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/1612-47-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/1612-4-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/1612-5-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/1612-6-0x0000000005C50000-0x0000000005E10000-memory.dmp

Filesize
1.8MB

Download
memory/1612-7-0x0000000005E10000-0x0000000005F88000-memory.dmp

Filesize
1.5MB

Download
memory/1612-2-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/1612-0-0x0000000000880000-0x0000000000B1A000-memory.dmp

Filesize
2.6MB

Download
memory/1612-3-0x0000000000390000-0x00000000003A2000-memory.dmp

Filesize
72KB

Download
memory/1868-37-0x0000000002810000-0x0000000002850000-memory.dmp

Filesize
256KB

Download
memory/1868-53-0x000000006EBD0000-0x000000006F17B000-memory.dmp

Filesize
5.7MB

Download
memory/1868-38-0x0000000002810000-0x0000000002850000-memory.dmp

Filesize
256KB

Download
memory/1868-34-0x000000006EBD0000-0x000000006F17B000-memory.dmp

Filesize
5.7MB

Download
memory/1868-35-0x0000000002810000-0x0000000002850000-memory.dmp

Filesize
256KB

Download
memory/1868-36-0x000000006EBD0000-0x000000006F17B000-memory.dmp

Filesize
5.7MB

Download
memory/2404-51-0x000000006EBD0000-0x000000006F17B000-memory.dmp

Filesize
5.7MB

Download
memory/2404-23-0x000000006EBD0000-0x000000006F17B000-memory.dmp

Filesize
5.7MB

Download
memory/2404-24-0x00000000024F0000-0x0000000002530000-memory.dmp

Filesize
256KB

Download
memory/2404-26-0x00000000024F0000-0x0000000002530000-memory.dmp

Filesize
256KB

Download
memory/2404-28-0x000000006EBD0000-0x000000006F17B000-memory.dmp

Filesize
5.7MB

Download
memory/2412-45-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-58-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-39-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-40-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-43-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2412-42-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-44-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-76-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-75-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-46-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-50-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-49-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-74-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-73-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-71-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-54-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-55-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-56-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-57-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-72-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-60-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-59-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-61-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-63-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-62-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-64-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-65-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-66-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-67-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-68-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-69-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2412-70-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2560-27-0x0000000002710000-0x0000000002750000-memory.dmp

Filesize
256KB

Download
memory/2560-20-0x000000006EBD0000-0x000000006F17B000-memory.dmp

Filesize
5.7MB

Download
memory/2560-21-0x0000000002710000-0x0000000002750000-memory.dmp

Filesize
256KB

Download
memory/2560-52-0x000000006EBD0000-0x000000006F17B000-memory.dmp

Filesize
5.7MB

Download
memory/2560-22-0x000000006EBD0000-0x000000006F17B000-memory.dmp

Filesize
5.7MB

Download
memory/2560-25-0x0000000002710000-0x0000000002750000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads