bitrat | 5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe
Size

1.4MB
MD5

9409fb1d5522f78fb94e44128f20cd36
SHA1

5ae5f36005a3a47787e6c8536b5ca1803dbca44e
SHA256

5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1
SHA512

b3d21f6e188329e999aaa5117e47304692cc319a9eed7d2e5a56e532c7d95b8a4a9b8ec7386bf7e90b730e793f00fc08c8389d41be91bc2dea0526dcbdd5aa38
SSDEEP

24576:6ndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzRbF6:8XDFBU2iIBb0xY/6sUYYkF

Score

10^/10

bitrat discovery trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

backu4734.duckdns.org:7904

Attributes

communication_password
202cb962ac59075b964b07152d234b70
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Bitrat family
bitrat

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe

pid	process
2792	5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe
2792	5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe
2792	5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe
2792	5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2792-0-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2792-2-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2792-6-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2792-11-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2792-15-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2792-20-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe

description pid process

Token: SeShutdownPrivilege 2792 5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe

description	pid	process
Token: SeShutdownPrivilege	2792	5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe

pid	process
2792	5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe
2792	5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe

C:\Users\Admin\AppData\Local\Temp\5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe
"C:\Users\Admin\AppData\Local\Temp\5f218a535ed51ebbc6821dc6c3777f375c2ea18ed1f9e52ca1198630b7527ae1.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2792-0-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2792-1-0x00000000745E0000-0x0000000074619000-memory.dmp

Filesize
228KB

Download
memory/2792-2-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2792-5-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/2792-6-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2792-10-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/2792-11-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2792-14-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/2792-15-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2792-19-0x0000000074960000-0x0000000074999000-memory.dmp

Filesize
228KB

Download
memory/2792-20-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download