bitrat | 11a1756f1a0d950273debd39cbf1f99b515cff9d46b2e78a533bd4100e078a12

General

Target

4c5c017fa0cf51bd814bd877d4448300N.exe
Size

5.0MB
MD5

4c5c017fa0cf51bd814bd877d4448300
SHA1

a94fec80255175db3e2a938c02a9b173e0fb498d
SHA256

11a1756f1a0d950273debd39cbf1f99b515cff9d46b2e78a533bd4100e078a12
SHA512

c3ef6c72c504e94de1ad8ac9fd75911a754e7ffbc87e5885029e0b668c938632c66d6cdad34caf0a8bb46aa886eda2fa970887e9eb61317d2bfe74e9b1627c2c
SSDEEP

98304:L7VmgrLl6EeNQ0kKDhLa1xecuMJWJ4qnP6x0V2ucdIlpzd3kU2V:LlLSQ0Nirvk2qSxHyzd3kn

Score

10^/10

bitrat discovery persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.34

C2

185.157.161.104:65312

Attributes

communication_password
81dc9bdb52d04dc20036dbd8313ed055
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4c5c017fa0cf51bd814bd877d4448300N.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\ProPlayer = "C:\\Users\\Admin\\AppData\\Roaming\\ProPlayer\\Player.exe.exe"	4c5c017fa0cf51bd814bd877d4448300N.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

4c5c017fa0cf51bd814bd877d4448300N.EXE

pid	process
2104	4c5c017fa0cf51bd814bd877d4448300N.EXE
2104	4c5c017fa0cf51bd814bd877d4448300N.EXE
2104	4c5c017fa0cf51bd814bd877d4448300N.EXE
2104	4c5c017fa0cf51bd814bd877d4448300N.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

4c5c017fa0cf51bd814bd877d4448300N.exe

description pid process target process

PID 2908 set thread context of 2104 2908 4c5c017fa0cf51bd814bd877d4448300N.exe 4c5c017fa0cf51bd814bd877d4448300N.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2908 set thread context of 2104	2908	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

4c5c017fa0cf51bd814bd877d4448300N.exeDllHost.exe4c5c017fa0cf51bd814bd877d4448300N.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c5c017fa0cf51bd814bd877d4448300N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c5c017fa0cf51bd814bd877d4448300N.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4c5c017fa0cf51bd814bd877d4448300N.EXE

description	pid	process
Token: SeDebugPrivilege	2104	4c5c017fa0cf51bd814bd877d4448300N.EXE
Token: SeShutdownPrivilege	2104	4c5c017fa0cf51bd814bd877d4448300N.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

2744 DllHost.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

4c5c017fa0cf51bd814bd877d4448300N.exe4c5c017fa0cf51bd814bd877d4448300N.EXE

pid process

2908 4c5c017fa0cf51bd814bd877d4448300N.exe
2104 4c5c017fa0cf51bd814bd877d4448300N.EXE
2104 4c5c017fa0cf51bd814bd877d4448300N.EXE

pid	process
2744	DllHost.exe

pid	process
2908	4c5c017fa0cf51bd814bd877d4448300N.exe
2104	4c5c017fa0cf51bd814bd877d4448300N.EXE
2104	4c5c017fa0cf51bd814bd877d4448300N.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

4c5c017fa0cf51bd814bd877d4448300N.exe

description	pid	process	target process
PID 2908 wrote to memory of 2104	2908	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2908 wrote to memory of 2104	2908	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2908 wrote to memory of 2104	2908	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2908 wrote to memory of 2104	2908	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2908 wrote to memory of 2104	2908	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2908 wrote to memory of 2104	2908	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2908 wrote to memory of 2104	2908	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2908 wrote to memory of 2104	2908	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2908 wrote to memory of 2104	2908	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2908 wrote to memory of 2104	2908	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2908 wrote to memory of 2104	2908	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2908 wrote to memory of 2104	2908	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE

C:\Users\Admin\AppData\Local\Temp\4c5c017fa0cf51bd814bd877d4448300N.exe
"C:\Users\Admin\AppData\Local\Temp\4c5c017fa0cf51bd814bd877d4448300N.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\4c5c017fa0cf51bd814bd877d4448300N.EXE
  "C:\Users\Admin\AppData\Local\Temp\4c5c017fa0cf51bd814bd877d4448300N.EXE"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2104

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\QpGDR.jpg

Filesize
358KB

MD5
6bf7995bed6622dc6c2123db53b6b17d

SHA1
4f644ae30a70c94204acaa931d48fc8bb6394ca8

SHA256
04405bd5f7c5868a5f95f286d0b951a888a10062b506959dc3bd149206f7c2f3

SHA512
7ff9f5d181159d127c0459c7347cb255d120abd2e315d9218391e8f0f616438f2c6f750ba84f6ba32c396dc6d631ab1069f5a1d4b0a33b5f2337b1421214a16e

Download Submit
memory/2104-26-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2104-28-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-15-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-35-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-23-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-54-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-19-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-17-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-14-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-12-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-29-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-25-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-53-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-8-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-51-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-10-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-52-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-38-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-41-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-40-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-42-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-47-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-46-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2104-48-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2744-36-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/2744-7-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/2744-4-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2908-3-0x0000000002740000-0x0000000002742000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads