bitrat | 11a1756f1a0d950273debd39cbf1f99b515cff9d46b2e78a533bd4100e078a12

General

Target

4c5c017fa0cf51bd814bd877d4448300N.exe
Size

5.0MB
MD5

4c5c017fa0cf51bd814bd877d4448300
SHA1

a94fec80255175db3e2a938c02a9b173e0fb498d
SHA256

11a1756f1a0d950273debd39cbf1f99b515cff9d46b2e78a533bd4100e078a12
SHA512

c3ef6c72c504e94de1ad8ac9fd75911a754e7ffbc87e5885029e0b668c938632c66d6cdad34caf0a8bb46aa886eda2fa970887e9eb61317d2bfe74e9b1627c2c
SSDEEP

98304:L7VmgrLl6EeNQ0kKDhLa1xecuMJWJ4qnP6x0V2ucdIlpzd3kU2V:LlLSQ0Nirvk2qSxHyzd3kn

Score

10^/10

bitrat discovery persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.34

C2

185.157.161.104:65312

Attributes

communication_password
81dc9bdb52d04dc20036dbd8313ed055
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4c5c017fa0cf51bd814bd877d4448300N.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ProPlayer = "C:\\Users\\Admin\\AppData\\Roaming\\ProPlayer\\Player.exe.exe"	4c5c017fa0cf51bd814bd877d4448300N.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

4c5c017fa0cf51bd814bd877d4448300N.EXE

pid	process
2832	4c5c017fa0cf51bd814bd877d4448300N.EXE
2832	4c5c017fa0cf51bd814bd877d4448300N.EXE
2832	4c5c017fa0cf51bd814bd877d4448300N.EXE
2832	4c5c017fa0cf51bd814bd877d4448300N.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

4c5c017fa0cf51bd814bd877d4448300N.exe

description pid process target process

PID 2928 set thread context of 2832 2928 4c5c017fa0cf51bd814bd877d4448300N.exe 4c5c017fa0cf51bd814bd877d4448300N.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2928 set thread context of 2832	2928	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

4c5c017fa0cf51bd814bd877d4448300N.exe4c5c017fa0cf51bd814bd877d4448300N.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c5c017fa0cf51bd814bd877d4448300N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c5c017fa0cf51bd814bd877d4448300N.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4c5c017fa0cf51bd814bd877d4448300N.EXE

description pid process

Token: SeShutdownPrivilege 2832 4c5c017fa0cf51bd814bd877d4448300N.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

4c5c017fa0cf51bd814bd877d4448300N.exe4c5c017fa0cf51bd814bd877d4448300N.EXE

pid process

2928 4c5c017fa0cf51bd814bd877d4448300N.exe
2832 4c5c017fa0cf51bd814bd877d4448300N.EXE
2832 4c5c017fa0cf51bd814bd877d4448300N.EXE

description	pid	process
Token: SeShutdownPrivilege	2832	4c5c017fa0cf51bd814bd877d4448300N.EXE

pid	process
2928	4c5c017fa0cf51bd814bd877d4448300N.exe
2832	4c5c017fa0cf51bd814bd877d4448300N.EXE
2832	4c5c017fa0cf51bd814bd877d4448300N.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

4c5c017fa0cf51bd814bd877d4448300N.exe

description	pid	process	target process
PID 2928 wrote to memory of 2832	2928	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2928 wrote to memory of 2832	2928	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2928 wrote to memory of 2832	2928	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2928 wrote to memory of 2832	2928	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2928 wrote to memory of 2832	2928	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2928 wrote to memory of 2832	2928	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2928 wrote to memory of 2832	2928	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2928 wrote to memory of 2832	2928	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2928 wrote to memory of 2832	2928	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2928 wrote to memory of 2832	2928	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE
PID 2928 wrote to memory of 2832	2928	4c5c017fa0cf51bd814bd877d4448300N.exe	4c5c017fa0cf51bd814bd877d4448300N.EXE

C:\Users\Admin\AppData\Local\Temp\4c5c017fa0cf51bd814bd877d4448300N.exe
"C:\Users\Admin\AppData\Local\Temp\4c5c017fa0cf51bd814bd877d4448300N.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\4c5c017fa0cf51bd814bd877d4448300N.EXE
  "C:\Users\Admin\AppData\Local\Temp\4c5c017fa0cf51bd814bd877d4448300N.EXE"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2832-5-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2832-7-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2832-8-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2832-6-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2832-10-0x00000000746D0000-0x0000000074709000-memory.dmp

Filesize
228KB

Download
memory/2832-11-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2832-17-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2832-18-0x0000000074A50000-0x0000000074A89000-memory.dmp

Filesize
228KB

Download
memory/2832-19-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2832-23-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2832-22-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2832-24-0x0000000074A50000-0x0000000074A89000-memory.dmp

Filesize
228KB

Download
memory/2832-25-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2832-29-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2832-30-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2832-31-0x0000000074A50000-0x0000000074A89000-memory.dmp

Filesize
228KB

Download
memory/2832-32-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2832-34-0x0000000074A50000-0x0000000074A89000-memory.dmp

Filesize
228KB

Download
memory/2832-36-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2832-37-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2832-38-0x0000000074A50000-0x0000000074A89000-memory.dmp

Filesize
228KB

Download
memory/2832-39-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads