bitrat | a777e0372a1a9202b89bc4528c03223e064b0e3db71559041fd884a6daed57c3

General

Target

Codes.exe
Size

6.4MB
MD5

e20a92ba803ccdce1a2508542816f047
SHA1

803131e516784cff0cb6ad6e6b5cb29bc39092b9
SHA256

db7619d7304cbb9c7ad4bf8c74836f241aecac1fda067f3ffadadf7ee6d44930
SHA512

72329831d13bf15f193af74ee558c5c391ff87dfc77132da533e67f8b16f0d43c16f6ecc6a2a24b3aff9d5b1263ecbfffa0057aadbefd1b2c28b8f8193494ccf
SSDEEP

196608:IqWzFJ74xQUlQDIpa86HyHp9tQ0Nirvk2qSxHyzd3kn:IqWzR6aPC9tHi/qS1yyn

Score

10^/10

bitrat persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.34

C2

185.157.161.104:65312

Attributes

communication_password
81dc9bdb52d04dc20036dbd8313ed055
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ProPlayer = "C:\\Users\\Admin\\AppData\\Roaming\\ProPlayer\\Player.exe.exe"	Codes.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4660	Codes.EXE
4660	Codes.EXE
4660	Codes.EXE
4660	Codes.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 4660	2412	Codes.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4660	Codes.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2412	Codes.exe
4660	Codes.EXE
4660	Codes.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 4660	2412	Codes.exe	82
PID 2412 wrote to memory of 4660	2412	Codes.exe	82
PID 2412 wrote to memory of 4660	2412	Codes.exe	82
PID 2412 wrote to memory of 4660	2412	Codes.exe	82
PID 2412 wrote to memory of 4660	2412	Codes.exe	82
PID 2412 wrote to memory of 4660	2412	Codes.exe	82
PID 2412 wrote to memory of 4660	2412	Codes.exe	82
PID 2412 wrote to memory of 4660	2412	Codes.exe	82
PID 2412 wrote to memory of 4660	2412	Codes.exe	82
PID 2412 wrote to memory of 4660	2412	Codes.exe	82
PID 2412 wrote to memory of 4660	2412	Codes.exe	82

C:\Users\Admin\AppData\Local\Temp\Codes.exe
"C:\Users\Admin\AppData\Local\Temp\Codes.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\Codes.EXE
  "C:\Users\Admin\AppData\Local\Temp\Codes.EXE"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4660-5-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-7-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-6-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-8-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-10-0x0000000074370000-0x00000000743A9000-memory.dmp

Filesize
228KB

Download
memory/4660-11-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-17-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-18-0x0000000074710000-0x0000000074749000-memory.dmp

Filesize
228KB

Download
memory/4660-19-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-22-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-21-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-23-0x0000000074710000-0x0000000074749000-memory.dmp

Filesize
228KB

Download
memory/4660-24-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-29-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-28-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-30-0x0000000074710000-0x0000000074749000-memory.dmp

Filesize
228KB

Download
memory/4660-31-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-34-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-35-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-36-0x0000000074710000-0x0000000074749000-memory.dmp

Filesize
228KB

Download
memory/4660-37-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-42-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-41-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/4660-43-0x0000000074710000-0x0000000074749000-memory.dmp

Filesize
228KB

Download
memory/4660-44-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads