bitrat | 214082ec55ebca25be21e5b5227ad0e89c08026c55a21fc57dc4bd2764f5d28f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
05/04/2025, 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rihuata-main/mbnorad.exe
Size

3.8MB
MD5

808005572c1c65a4a6166ed83f7180b4
SHA1

0c5818685f1a9bfe42dfad3323e964176d245e1c
SHA256

1f0279acdb1535a39a82d8a1baaf10e9dc307c043e38f53752e64408b50c58aa
SHA512

73cbcd79dfa5de8576afb4900a0a152329c76ac88e0cb2cc2e1c4ab4bae041b2eb04720490a7509e23fc267fcfa37d8dca6df68bb0ffbbf892bb1e7a887be80c
SSDEEP

98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/PmlwXVZ4FB:5+R/eZADUXR

Score

10^/10

bitrat discovery persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

31.177.110.225:8080

Attributes

communication_password
81dc9bdb52d04dc20036dbd8313ed055
install_dir
Appdata
install_file
FileManager
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Bitrat family
bitrat

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2423602651-1712563293-711691555-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FileManager = "C:\\Users\\Admin\\AppData\\Local\\Appdata\\FileManager䜀"	mbnorad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2423602651-1712563293-711691555-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FileManager = "C:\\Users\\Admin\\AppData\\Local\\Appdata\\FileManager"	mbnorad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2423602651-1712563293-711691555-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FileManager = "C:\\Users\\Admin\\AppData\\Local\\Appdata\\FileManagerȀ"	mbnorad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2423602651-1712563293-711691555-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FileManager = "C:\\Users\\Admin\\AppData\\Local\\Appdata\\FileManager餀"	mbnorad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2423602651-1712563293-711691555-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FileManager = "C:\\Users\\Admin\\AppData\\Local\\Appdata\\FileManager瘀"	mbnorad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2423602651-1712563293-711691555-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FileManager = "C:\\Users\\Admin\\AppData\\Local\\Appdata\\FileManager怀"	mbnorad.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbnorad.exe

Suspicious behavior: RenamesItself 30 IoCs

pid	Process
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe
5372	mbnorad.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5372	mbnorad.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5372	mbnorad.exe
5372	mbnorad.exe

C:\Users\Admin\AppData\Local\Temp\rihuata-main\mbnorad.exe
"C:\Users\Admin\AppData\Local\Temp\rihuata-main\mbnorad.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:5648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:3332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:4880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:4836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:5000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:2004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:4204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:4128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:3808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:4328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:5620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:4892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:1808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:5476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:5840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:3232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:1680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:1092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:4360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:5396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:5444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:4908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:2264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:4028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:2368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:4756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:4960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:5532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Appdata\FileManager
1⤵
PID:5956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\09T9F81Y\getUpdates[1].json

Filesize
23B

MD5
3aea26bbb1a80be6defef5e08b785138

SHA1
47bd5d2600766cb214972441b754fbf0e2e1a458

SHA256
2321bd0dcab3570cb4b36871411be2b13d70ccbaca5db547ed054b87ee563684

SHA512
1f9bd684b0ee7f3b5a427f4899b86aec322931ad835e2f05c8cebb52a8c03d59f6ad3c7e37fc340035fe3a5b0d891cb626f8f2a32568ff337d656a3a8636a7a9

Download Submit
memory/5372-42-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5372-46-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5372-3-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5372-0-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5372-17-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5372-1-0x00000000748E0000-0x0000000074919000-memory.dmp

Filesize
228KB

Download
memory/5372-24-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5372-31-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5372-2-0x0000000074800000-0x0000000074839000-memory.dmp

Filesize
228KB

Download
memory/5372-35-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5372-4-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5372-50-0x00000000748E0000-0x0000000074919000-memory.dmp

Filesize
228KB

Download
memory/5372-51-0x0000000074800000-0x0000000074839000-memory.dmp

Filesize
228KB

Download
memory/5372-55-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5372-59-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5372-66-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5372-70-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5372-77-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5372-81-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads