bitrat | e1b20a947e37528f38157fd59f0f1fac2b220247c657f6756304026b7e64f814

General

Target

15a52de73b3395308f5806176d575c6b.exe
Size

4.3MB
MD5

15a52de73b3395308f5806176d575c6b
SHA1

21ff34e8dcc57c6708655d8a346ce73b5e92d729
SHA256

e1b20a947e37528f38157fd59f0f1fac2b220247c657f6756304026b7e64f814
SHA512

c101177ea3b7b34c17eb07e2ca503165a669f955daea0fd6c3cc7b11b18d90394e51c33831273fe77ed60a27b031de2b764a7d4205653ccb4f87102304b11f52

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

queentaline.ddns.net:1117

Attributes

communication_password
202cb962ac59075b964b07152d234b70
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

15a52de73b3395308f5806176d575c6b.exe

pid	process
472	15a52de73b3395308f5806176d575c6b.exe
472	15a52de73b3395308f5806176d575c6b.exe
472	15a52de73b3395308f5806176d575c6b.exe
472	15a52de73b3395308f5806176d575c6b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

15a52de73b3395308f5806176d575c6b.exe

description pid process target process

PID 1208 set thread context of 472 1208 15a52de73b3395308f5806176d575c6b.exe 15a52de73b3395308f5806176d575c6b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1124 schtasks.exe

description	pid	process	target process
PID 1208 set thread context of 472	1208	15a52de73b3395308f5806176d575c6b.exe	15a52de73b3395308f5806176d575c6b.exe

pid	process
1124	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

15a52de73b3395308f5806176d575c6b.exepowershell.exe

pid	process
1208	15a52de73b3395308f5806176d575c6b.exe
1208	15a52de73b3395308f5806176d575c6b.exe
1208	15a52de73b3395308f5806176d575c6b.exe
1208	15a52de73b3395308f5806176d575c6b.exe
1208	15a52de73b3395308f5806176d575c6b.exe
1208	15a52de73b3395308f5806176d575c6b.exe
1208	15a52de73b3395308f5806176d575c6b.exe
1208	15a52de73b3395308f5806176d575c6b.exe
1208	15a52de73b3395308f5806176d575c6b.exe
624	powershell.exe
1208	15a52de73b3395308f5806176d575c6b.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

15a52de73b3395308f5806176d575c6b.exepowershell.exe15a52de73b3395308f5806176d575c6b.exe

description	pid	process
Token: SeDebugPrivilege	1208	15a52de73b3395308f5806176d575c6b.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeDebugPrivilege	472	15a52de73b3395308f5806176d575c6b.exe
Token: SeShutdownPrivilege	472	15a52de73b3395308f5806176d575c6b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

15a52de73b3395308f5806176d575c6b.exe

pid process

472 15a52de73b3395308f5806176d575c6b.exe
472 15a52de73b3395308f5806176d575c6b.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

15a52de73b3395308f5806176d575c6b.exe

C:\Users\Admin\AppData\Local\Temp\15a52de73b3395308f5806176d575c6b.exe
"C:\Users\Admin\AppData\Local\Temp\15a52de73b3395308f5806176d575c6b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RoIwWS.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RoIwWS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp13DF.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1124
- C:\Users\Admin\AppData\Local\Temp\15a52de73b3395308f5806176d575c6b.exe
  "C:\Users\Admin\AppData\Local\Temp\15a52de73b3395308f5806176d575c6b.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp13DF.tmp

Filesize
1KB

MD5
8ba2ab3029b6a97332c88803ff4adf92

SHA1
146eb52cea3bfbbd7d5b8f9add12494702b46af5

SHA256
0bde4abd07c0b4123b1601968e181d4834675cfc2de09234d607adbe0d61fb65

SHA512
e07ae6b10d086c7ccf5f70b9afc9c0c406e38d686c28c8f6171dbf8c144047960bb46cff32e1c72458a44d1e424bab7af6377fb66c01e23ae80eac1c339b05ef

Download Submit
memory/472-73-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/472-63-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/472-68-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/472-72-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/472-70-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/472-83-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/472-77-0x000000000068A488-mapping.dmp

Download
memory/472-76-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/472-64-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/472-66-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/472-81-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/472-79-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/624-58-0x0000000000000000-mapping.dmp

Download
memory/624-74-0x000000006E9B0000-0x000000006EF5B000-memory.dmp

Filesize
5.7MB

Download
memory/624-82-0x000000006E9B0000-0x000000006EF5B000-memory.dmp

Filesize
5.7MB

Download
memory/1124-59-0x0000000000000000-mapping.dmp

Download
memory/1208-54-0x00000000009D0000-0x0000000000E16000-memory.dmp

Filesize
4.3MB

Download
memory/1208-56-0x00000000007D0000-0x00000000007E6000-memory.dmp

Filesize
88KB

Download
memory/1208-57-0x0000000009370000-0x000000000973E000-memory.dmp

Filesize
3.8MB

Download
memory/1208-62-0x000000000B210000-0x000000000B5DA000-memory.dmp

Filesize
3.8MB

Download
memory/1208-55-0x00000000758D1000-0x00000000758D3000-memory.dmp

Filesize
8KB

Download

description	pid	process	target process
PID 1208 wrote to memory of 624	1208	15a52de73b3395308f5806176d575c6b.exe	powershell.exe
PID 1208 wrote to memory of 624	1208	15a52de73b3395308f5806176d575c6b.exe	powershell.exe
PID 1208 wrote to memory of 624	1208	15a52de73b3395308f5806176d575c6b.exe	powershell.exe
PID 1208 wrote to memory of 624	1208	15a52de73b3395308f5806176d575c6b.exe	powershell.exe
PID 1208 wrote to memory of 1124	1208	15a52de73b3395308f5806176d575c6b.exe	schtasks.exe
PID 1208 wrote to memory of 1124	1208	15a52de73b3395308f5806176d575c6b.exe	schtasks.exe
PID 1208 wrote to memory of 1124	1208	15a52de73b3395308f5806176d575c6b.exe	schtasks.exe
PID 1208 wrote to memory of 1124	1208	15a52de73b3395308f5806176d575c6b.exe	schtasks.exe
PID 1208 wrote to memory of 472	1208	15a52de73b3395308f5806176d575c6b.exe	15a52de73b3395308f5806176d575c6b.exe
PID 1208 wrote to memory of 472	1208	15a52de73b3395308f5806176d575c6b.exe	15a52de73b3395308f5806176d575c6b.exe
PID 1208 wrote to memory of 472	1208	15a52de73b3395308f5806176d575c6b.exe	15a52de73b3395308f5806176d575c6b.exe
PID 1208 wrote to memory of 472	1208	15a52de73b3395308f5806176d575c6b.exe	15a52de73b3395308f5806176d575c6b.exe
PID 1208 wrote to memory of 472	1208	15a52de73b3395308f5806176d575c6b.exe	15a52de73b3395308f5806176d575c6b.exe
PID 1208 wrote to memory of 472	1208	15a52de73b3395308f5806176d575c6b.exe	15a52de73b3395308f5806176d575c6b.exe
PID 1208 wrote to memory of 472	1208	15a52de73b3395308f5806176d575c6b.exe	15a52de73b3395308f5806176d575c6b.exe
PID 1208 wrote to memory of 472	1208	15a52de73b3395308f5806176d575c6b.exe	15a52de73b3395308f5806176d575c6b.exe
PID 1208 wrote to memory of 472	1208	15a52de73b3395308f5806176d575c6b.exe	15a52de73b3395308f5806176d575c6b.exe
PID 1208 wrote to memory of 472	1208	15a52de73b3395308f5806176d575c6b.exe	15a52de73b3395308f5806176d575c6b.exe
PID 1208 wrote to memory of 472	1208	15a52de73b3395308f5806176d575c6b.exe	15a52de73b3395308f5806176d575c6b.exe
PID 1208 wrote to memory of 472	1208	15a52de73b3395308f5806176d575c6b.exe	15a52de73b3395308f5806176d575c6b.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads