bitrat | b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c

General

Target

b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
Size

4.4MB
MD5

0c09d75a290024791e700607ecea59e3
SHA1

e69abb2295667c1ad8abae715c5ed10b387b0bb8
SHA256

b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c
SHA512

1bb58ffa224869a2ceb7a9af83de6e5aad99c899b67888e17329836a959058f92133373a015ffae945d9b2c0769a9b1b49a034d5f87bf3dc0fb189b739cdd7b0

Score

10^/10

bitrat evasion trojan

Malware Config

Extracted

Family

bitrat

Version

1.33

C2

23.105.131.186:9000

Attributes

communication_password
c4ca4238a0b923820dcc509a6f75849b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/552-56-0x00000000003A0000-0x00000000003B8000-memory.dmp	net_reactor

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

pid	process
2012	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
2012	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
2012	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
2012	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

description	pid	process	target process
PID 552 set thread context of 2012	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1676 schtasks.exe

pid	process
1676	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

description	pid	process
Token: SeDebugPrivilege	2012	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
Token: SeShutdownPrivilege	2012	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

pid	process
2012	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
2012	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

C:\Users\Admin\AppData\Local\Temp\b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
"C:\Users\Admin\AppData\Local\Temp\b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fSPvHEGTrwgc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD672.tmp"
2⤵
- Creates scheduled task(s)
PID:1676

C:\Users\Admin\AppData\Local\Temp\b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
"C:\Users\Admin\AppData\Local\Temp\b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD672.tmp

Filesize
1KB

MD5
1e8b73f9e2214e9f32b0394d491d2bff

SHA1
7d86b8e4174d905687ce2c61fd9e586cecad9763

SHA256
c461f0d72e95c5a54e77a7aa35e26a63577a5cd7cc5fc9a0ec74927dcb38d015

SHA512
799b6e4f4f1985426ea51781e12ac06875ab59fdeac2bb18039a6962d2f3be67d0a0a083813cdd6f7351fa245a2d963f8ebdece0fc4b16543ec2982fe488ae34

Download Submit
memory/552-54-0x0000000000E80000-0x00000000012E6000-memory.dmp

Filesize
4.4MB

Download
memory/552-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/552-56-0x00000000003A0000-0x00000000003B8000-memory.dmp

Filesize
96KB

Download
memory/552-57-0x0000000007620000-0x0000000007A02000-memory.dmp

Filesize
3.9MB

Download
memory/552-58-0x0000000008A00000-0x0000000008DBC000-memory.dmp

Filesize
3.7MB

Download
memory/1676-59-0x0000000000000000-mapping.dmp

Download
memory/2012-62-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2012-61-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2012-64-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2012-68-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2012-66-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2012-70-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2012-71-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2012-73-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2012-74-0x000000000068116D-mapping.dmp

Download
memory/2012-76-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2012-78-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2012-79-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download

description	pid	process	target process
PID 552 wrote to memory of 1676	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	schtasks.exe
PID 552 wrote to memory of 1676	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	schtasks.exe
PID 552 wrote to memory of 1676	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	schtasks.exe
PID 552 wrote to memory of 1676	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	schtasks.exe
PID 552 wrote to memory of 2012	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
PID 552 wrote to memory of 2012	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
PID 552 wrote to memory of 2012	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
PID 552 wrote to memory of 2012	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
PID 552 wrote to memory of 2012	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
PID 552 wrote to memory of 2012	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
PID 552 wrote to memory of 2012	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
PID 552 wrote to memory of 2012	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
PID 552 wrote to memory of 2012	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
PID 552 wrote to memory of 2012	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
PID 552 wrote to memory of 2012	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe
PID 552 wrote to memory of 2012	552	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe	b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads