bitrat | da8f7c39a3136c6546c6f2e36872be49ddd7a8dd53002e12d04739680e4821b8

General

Target

3f6cd0ff8f90ba35fe22b94e55655c96.exe
Size

64KB
MD5

3f6cd0ff8f90ba35fe22b94e55655c96
SHA1

eabdde0d8d5ff3dee1690e322184d7ec2f3f5d10
SHA256

da8f7c39a3136c6546c6f2e36872be49ddd7a8dd53002e12d04739680e4821b8
SHA512

8d51772b8ffce6b9aef3f1068f067811ae65ce00aca058bbef1e1a847efdb90552fc9c9bd31de0b23da03982e4eb13689caee5fb08ecdff02e3b306ca539322a
SSDEEP

1536:gwdyfgYBUngABZvxZ/DOG8s8MkeNSzXzKN:gwdyRapBZP/Dl8DMDSzX+N

Score

10^/10

bitrat persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

37.139.128.233:3569

Attributes

communication_password
ce952068942604a6d6df06ed5002fad6
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3f6cd0ff8f90ba35fe22b94e55655c96.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	3f6cd0ff8f90ba35fe22b94e55655c96.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3f6cd0ff8f90ba35fe22b94e55655c96.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bgroyh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oklsztakdy\\Bgroyh.exe\""	3f6cd0ff8f90ba35fe22b94e55655c96.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

3f6cd0ff8f90ba35fe22b94e55655c96.exe

pid process

4840 3f6cd0ff8f90ba35fe22b94e55655c96.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

3f6cd0ff8f90ba35fe22b94e55655c96.exe

description pid process target process

PID 3140 set thread context of 4840 3140 3f6cd0ff8f90ba35fe22b94e55655c96.exe 3f6cd0ff8f90ba35fe22b94e55655c96.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3088 powershell.exe
3088 powershell.exe

pid	process
4840	3f6cd0ff8f90ba35fe22b94e55655c96.exe

description	pid	process	target process
PID 3140 set thread context of 4840	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe	3f6cd0ff8f90ba35fe22b94e55655c96.exe

pid	process
3088	powershell.exe
3088	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

3f6cd0ff8f90ba35fe22b94e55655c96.exepowershell.exe3f6cd0ff8f90ba35fe22b94e55655c96.exe

description	pid	process
Token: SeDebugPrivilege	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeShutdownPrivilege	4840	3f6cd0ff8f90ba35fe22b94e55655c96.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

3f6cd0ff8f90ba35fe22b94e55655c96.exe

description	pid	process	target process
PID 3140 wrote to memory of 3088	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe	powershell.exe
PID 3140 wrote to memory of 3088	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe	powershell.exe
PID 3140 wrote to memory of 3088	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe	powershell.exe
PID 3140 wrote to memory of 4840	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe	3f6cd0ff8f90ba35fe22b94e55655c96.exe
PID 3140 wrote to memory of 4840	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe	3f6cd0ff8f90ba35fe22b94e55655c96.exe
PID 3140 wrote to memory of 4840	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe	3f6cd0ff8f90ba35fe22b94e55655c96.exe
PID 3140 wrote to memory of 4840	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe	3f6cd0ff8f90ba35fe22b94e55655c96.exe
PID 3140 wrote to memory of 4840	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe	3f6cd0ff8f90ba35fe22b94e55655c96.exe
PID 3140 wrote to memory of 4840	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe	3f6cd0ff8f90ba35fe22b94e55655c96.exe
PID 3140 wrote to memory of 4840	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe	3f6cd0ff8f90ba35fe22b94e55655c96.exe
PID 3140 wrote to memory of 4840	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe	3f6cd0ff8f90ba35fe22b94e55655c96.exe
PID 3140 wrote to memory of 4840	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe	3f6cd0ff8f90ba35fe22b94e55655c96.exe
PID 3140 wrote to memory of 4840	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe	3f6cd0ff8f90ba35fe22b94e55655c96.exe
PID 3140 wrote to memory of 4840	3140	3f6cd0ff8f90ba35fe22b94e55655c96.exe	3f6cd0ff8f90ba35fe22b94e55655c96.exe

C:\Users\Admin\AppData\Local\Temp\3f6cd0ff8f90ba35fe22b94e55655c96.exe
"C:\Users\Admin\AppData\Local\Temp\3f6cd0ff8f90ba35fe22b94e55655c96.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA5AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3088

C:\Users\Admin\AppData\Local\Temp\3f6cd0ff8f90ba35fe22b94e55655c96.exe
C:\Users\Admin\AppData\Local\Temp\3f6cd0ff8f90ba35fe22b94e55655c96.exe
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4840

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3088-140-0x0000000005A20000-0x0000000005A86000-memory.dmp

Filesize
408KB

Download
memory/3088-141-0x0000000006060000-0x000000000607E000-memory.dmp

Filesize
120KB

Download
memory/3088-136-0x0000000000000000-mapping.dmp

Download
memory/3088-137-0x0000000002A70000-0x0000000002AA6000-memory.dmp

Filesize
216KB

Download
memory/3088-138-0x0000000005380000-0x00000000059A8000-memory.dmp

Filesize
6.2MB

Download
memory/3088-139-0x00000000052A0000-0x0000000005306000-memory.dmp

Filesize
408KB

Download
memory/3088-143-0x0000000006540000-0x000000000655A000-memory.dmp

Filesize
104KB

Download
memory/3088-142-0x00000000076C0000-0x0000000007D3A000-memory.dmp

Filesize
6.5MB

Download
memory/3140-132-0x0000000000CD0000-0x0000000000CE6000-memory.dmp

Filesize
88KB

Download
memory/3140-135-0x0000000007580000-0x00000000075A2000-memory.dmp

Filesize
136KB

Download
memory/3140-134-0x0000000007C00000-0x00000000081A4000-memory.dmp

Filesize
5.6MB

Download
memory/3140-133-0x00000000075B0000-0x0000000007642000-memory.dmp

Filesize
584KB

Download
memory/4840-150-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4840-145-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4840-146-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4840-147-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4840-148-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4840-149-0x0000000074610000-0x0000000074649000-memory.dmp

Filesize
228KB

Download
memory/4840-144-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads