bitrat | 2a2ce0aca043486b9b1995b262cd4611b1376fc4b18440d7d4b3ee8cfff2c76a

Reason

Machine shutdown

General

Target

pob.exe
Size

66KB
MD5

083e61fc5f310a663f5253286735d36e
SHA1

a4f6ae6c3eaa32d21831af0d4001d44c0c2f7083
SHA256

2a2ce0aca043486b9b1995b262cd4611b1376fc4b18440d7d4b3ee8cfff2c76a
SHA512

32ea2de1f5e195efb1aad00b9812eda6ee962bd0e3146d813b630e614a6c8d4b363ee1eaba3b610d63852a1b4e6cf7036bc7ac99be959cf215d61389f8caf82f

Score

10^/10

bitrat bootkit ransomware trojan

Malware Config

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3516-14-0x0000000000400000-0x00000000007CD000-memory.dmp	family_bitrat
behavioral2/memory/3516-15-0x0000000000689A84-mapping.dmp	family_bitrat
behavioral2/memory/3516-16-0x0000000000400000-0x00000000007CD000-memory.dmp	family_bitrat

Beds Protector Packer 1 IoCs

Detects Beds Protector packer used to load .NET malware.

Processes:

resource	yara_rule
behavioral2/memory/4052-10-0x0000000006430000-0x0000000006623000-memory.dmp	beds_protector

Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs
Enables rebooting of the machine without requiring login credentials.
ransomware bootkit

Winlogon Helper DLL
T1004

Modify Registry
T1112

Processes:

LogonUI.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked LogonUI.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked	LogonUI.exe

Drops startup file 2 IoCs

Processes:

pob.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pob.exe	pob.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pob.exe	pob.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

pob.exe

pid process

3516 pob.exe
3516 pob.exe
3516 pob.exe
3516 pob.exe
3516 pob.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

pob.exe

description pid process target process

PID 4052 set thread context of 3516 4052 pob.exe pob.exe

pid	process
3516	pob.exe
3516	pob.exe
3516	pob.exe
3516	pob.exe
3516	pob.exe

description	pid	process	target process
PID 4052 set thread context of 3516	4052	pob.exe	pob.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

pob.exe

pid	process
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe
4052	pob.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pob.exepob.exe

description pid process

Token: SeDebugPrivilege 4052 pob.exe
Token: SeShutdownPrivilege 3516 pob.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

pob.exeLogonUI.exe

pid process

3516 pob.exe
3516 pob.exe
2456 LogonUI.exe
2456 LogonUI.exe

description	pid	process
Token: SeDebugPrivilege	4052	pob.exe
Token: SeShutdownPrivilege	3516	pob.exe

pid	process
3516	pob.exe
3516	pob.exe
2456	LogonUI.exe
2456	LogonUI.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

pob.exe

description	pid	process	target process
PID 4052 wrote to memory of 3516	4052	pob.exe	pob.exe
PID 4052 wrote to memory of 3516	4052	pob.exe	pob.exe
PID 4052 wrote to memory of 3516	4052	pob.exe	pob.exe
PID 4052 wrote to memory of 3516	4052	pob.exe	pob.exe
PID 4052 wrote to memory of 3516	4052	pob.exe	pob.exe
PID 4052 wrote to memory of 3516	4052	pob.exe	pob.exe
PID 4052 wrote to memory of 3516	4052	pob.exe	pob.exe
PID 4052 wrote to memory of 3516	4052	pob.exe	pob.exe
PID 4052 wrote to memory of 3516	4052	pob.exe	pob.exe
PID 4052 wrote to memory of 3516	4052	pob.exe	pob.exe
PID 4052 wrote to memory of 3516	4052	pob.exe	pob.exe

C:\Users\Admin\AppData\Local\Temp\pob.exe
"C:\Users\Admin\AppData\Local\Temp\pob.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052

C:\Users\Admin\AppData\Local\Temp\pob.exe
"C:\Users\Admin\AppData\Local\Temp\pob.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3516

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ad2055 /state1:0x41c64e6d
1⤵
- Modifies WinLogon to allow AutoLogon
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2456

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3516-14-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3516-16-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3516-15-0x0000000000689A84-mapping.dmp

Download
memory/4052-9-0x0000000004F70000-0x0000000004F71000-memory.dmp

Filesize
4KB

Download
memory/4052-7-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/4052-8-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/4052-2-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/4052-10-0x0000000006430000-0x0000000006623000-memory.dmp

Filesize
1.9MB

Download
memory/4052-11-0x0000000007BC0000-0x0000000007BC1000-memory.dmp

Filesize
4KB

Download
memory/4052-12-0x0000000007C60000-0x0000000007C61000-memory.dmp

Filesize
4KB

Download
memory/4052-13-0x0000000007F20000-0x0000000007F21000-memory.dmp

Filesize
4KB

Download
memory/4052-6-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Filesize
4KB

Download
memory/4052-5-0x00000000054C0000-0x00000000054C1000-memory.dmp

Filesize
4KB

Download
memory/4052-3-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads