bitrat | a777e0372a1a9202b89bc4528c03223e064b0e3db71559041fd884a6daed57c3

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 04:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Codes.exe
Size

6.4MB
MD5

e20a92ba803ccdce1a2508542816f047
SHA1

803131e516784cff0cb6ad6e6b5cb29bc39092b9
SHA256

db7619d7304cbb9c7ad4bf8c74836f241aecac1fda067f3ffadadf7ee6d44930
SHA512

72329831d13bf15f193af74ee558c5c391ff87dfc77132da533e67f8b16f0d43c16f6ecc6a2a24b3aff9d5b1263ecbfffa0057aadbefd1b2c28b8f8193494ccf
SSDEEP

196608:IqWzFJ74xQUlQDIpa86HyHp9tQ0Nirvk2qSxHyzd3kn:IqWzR6aPC9tHi/qS1yyn

Score

10^/10

bitrat persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.34

185.157.161.104:65312

Attributes

communication_password
81dc9bdb52d04dc20036dbd8313ed055
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Codes.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\ProPlayer = "C:\\Users\\Admin\\AppData\\Roaming\\ProPlayer\\Player.exe.exe"	Codes.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

Codes.EXE

pid process

2664 Codes.EXE
2664 Codes.EXE
2664 Codes.EXE
2664 Codes.EXE
Suspicious use of SetThreadContext 1 IoCs

Processes:

Codes.exe

description pid process target process

PID 3056 set thread context of 2664 3056 Codes.exe Codes.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Codes.EXE

description pid process

Token: SeDebugPrivilege 2664 Codes.EXE
Token: SeShutdownPrivilege 2664 Codes.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

2340 DllHost.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

Codes.exeCodes.EXE

pid process

3056 Codes.exe
2664 Codes.EXE
2664 Codes.EXE

pid	process
2664	Codes.EXE
2664	Codes.EXE
2664	Codes.EXE
2664	Codes.EXE

description	pid	process	target process
PID 3056 set thread context of 2664	3056	Codes.exe	Codes.EXE

description	pid	process
Token: SeDebugPrivilege	2664	Codes.EXE
Token: SeShutdownPrivilege	2664	Codes.EXE

pid	process
2340	DllHost.exe

pid	process
3056	Codes.exe
2664	Codes.EXE
2664	Codes.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Codes.exe

description	pid	process	target process
PID 3056 wrote to memory of 2664	3056	Codes.exe	Codes.EXE
PID 3056 wrote to memory of 2664	3056	Codes.exe	Codes.EXE
PID 3056 wrote to memory of 2664	3056	Codes.exe	Codes.EXE
PID 3056 wrote to memory of 2664	3056	Codes.exe	Codes.EXE
PID 3056 wrote to memory of 2664	3056	Codes.exe	Codes.EXE
PID 3056 wrote to memory of 2664	3056	Codes.exe	Codes.EXE
PID 3056 wrote to memory of 2664	3056	Codes.exe	Codes.EXE
PID 3056 wrote to memory of 2664	3056	Codes.exe	Codes.EXE
PID 3056 wrote to memory of 2664	3056	Codes.exe	Codes.EXE
PID 3056 wrote to memory of 2664	3056	Codes.exe	Codes.EXE
PID 3056 wrote to memory of 2664	3056	Codes.exe	Codes.EXE
PID 3056 wrote to memory of 2664	3056	Codes.exe	Codes.EXE

C:\Users\Admin\AppData\Local\Temp\Codes.exe
"C:\Users\Admin\AppData\Local\Temp\Codes.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056

C:\Users\Admin\AppData\Local\Temp\Codes.EXE
"C:\Users\Admin\AppData\Local\Temp\Codes.EXE"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2664

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:2340

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ABbUT.jpg
Filesize
2.2MB

MD5
8c7657ee946b1d37c54218e99e3b53b3

SHA1
49a53c307306f27ab97be7efcd5e5be5d374931e

SHA256
8eabd8e972ca3ec54c062f00741b1a016c8355aebc8f9a38e82c8aac75e59a31

SHA512
5a0a7a5d7d9b5992e327396c267952880ddecd57a74143d5608157d7262df4875439d1464f22b1e7d5afeb85f59838c2e5ee29521971ed91ad7859635f7e1071

Download Submit
memory/2340-34-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2340-7-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2340-4-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download
memory/2664-31-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-27-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-13-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-12-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-10-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-22-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-21-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-19-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2664-16-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-15-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-25-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-8-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-14-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-32-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-54-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-35-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-36-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-37-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-41-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-42-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-43-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-47-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-46-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-48-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-53-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2664-52-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3056-3-0x0000000000860000-0x0000000000862000-memory.dmp

Filesize
8KB

Download