bitrat | 2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557

General

Target

2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe
Size

4.3MB
MD5

800a72a1b10482664128955fd3878dd5
SHA1

c8bb5f18dfd9ffb397c3e2615b8494c9ac858b14
SHA256

2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557
SHA512

d42d51205b9f4591a3b06c47fdf0b0e6836ce65c69da8f72e596a66c3c69d095c4e4b01e10ef96ec62560bae64d62d121a9689a435651d78a2b639d0e5db5341
SSDEEP

98304:12kBmhP9BU5yJcRzLU85bn9yLCJkkAiQpElkjZSYGoYK2fqWIpHV+wcgd9KEGzPc:wPwCCN5QLCJBAiQpElkjYY6K2oVSczG

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.34

C2

185.157.162.234:54262

Attributes

communication_password
2bb232c0b13c774965ef8558f0fbd615
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

RegSvcs.exe

pid process

1144 RegSvcs.exe
1144 RegSvcs.exe
1144 RegSvcs.exe
1144 RegSvcs.exe

pid	process
1144	RegSvcs.exe
1144	RegSvcs.exe
1144	RegSvcs.exe
1144	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe

description	pid	process	target process
PID 696 set thread context of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

632 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1144 RegSvcs.exe
Token: SeShutdownPrivilege 1144 RegSvcs.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

RegSvcs.exe

pid process

1144 RegSvcs.exe
1144 RegSvcs.exe

pid	process
632	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1144	RegSvcs.exe
Token: SeShutdownPrivilege	1144	RegSvcs.exe

pid	process
1144	RegSvcs.exe
1144	RegSvcs.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe

description	pid	process	target process
PID 696 wrote to memory of 632	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	schtasks.exe
PID 696 wrote to memory of 632	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	schtasks.exe
PID 696 wrote to memory of 632	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	schtasks.exe
PID 696 wrote to memory of 632	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	schtasks.exe
PID 696 wrote to memory of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe
PID 696 wrote to memory of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe
PID 696 wrote to memory of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe
PID 696 wrote to memory of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe
PID 696 wrote to memory of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe
PID 696 wrote to memory of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe
PID 696 wrote to memory of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe
PID 696 wrote to memory of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe
PID 696 wrote to memory of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe
PID 696 wrote to memory of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe
PID 696 wrote to memory of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe
PID 696 wrote to memory of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe
PID 696 wrote to memory of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe
PID 696 wrote to memory of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe
PID 696 wrote to memory of 1144	696	2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe
"C:\Users\Admin\AppData\Local\Temp\2a976682956855209a0d5e49d5c40f0d98ff85bd0e91c6b57f58e5151af42557.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:696

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QYwJDZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp734D.tmp"
2⤵
- Creates scheduled task(s)
PID:632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp734D.tmp

Filesize
1KB

MD5
c03efd3e1371ed42865df06144aa6f74

SHA1
8866679b669a1a08fe3d2b74818820a5d9f95c01

SHA256
0450be22e5289b0b454b66692137767bb3c6888baff9af2162a15a08d53ad5a2

SHA512
fa3539f27cfbdc0dbb291145ea8a4170c5996dc87eaeb2d798707428fc0dad18f364dd4205abb152de3ad9157d3e4f4dbfbdc672de21d9ad9c5ae93b8624f5fb

Download Submit
memory/632-58-0x0000000000000000-mapping.dmp

Download
memory/696-54-0x0000000000FA0000-0x00000000013EE000-memory.dmp

Filesize
4.3MB

Download
memory/696-55-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/696-56-0x0000000000430000-0x000000000043A000-memory.dmp

Filesize
40KB

Download
memory/696-57-0x0000000007290000-0x0000000007686000-memory.dmp

Filesize
4.0MB

Download
memory/1144-63-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1144-61-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1144-60-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1144-65-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1144-67-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1144-69-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1144-70-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1144-72-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1144-73-0x0000000000689A84-mapping.dmp

Download
memory/1144-75-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1144-77-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1144-78-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads