bitrat | f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592

General

Target

f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe
Size

5.5MB
MD5

ac699cd9c851cca2acf025657c5792f0
SHA1

1afe48edc49e018329e35a4d8ffb543bee488a3f
SHA256

f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592
SHA512

116bb93e95cc03d4b803c2cace8bcf45f47a44e4315cc24f9710509ec1078eb4d4679b13054d94fe6b0c74c833c8c681339739554d96220364991b383396d886
SSDEEP

98304:lVHhjviEClQVdlu3YmBZULTSGMxsBFlml+HRCfgfWQVn4yovjh2YSCSFe:PBjKEvjWYmBCKhmBDeMCSWQVn4y62YSM

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.34

C2

185.157.162.234:54262

Attributes

communication_password
2bb232c0b13c774965ef8558f0fbd615
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

RegSvcs.exe

pid process

1976 RegSvcs.exe
1976 RegSvcs.exe
1976 RegSvcs.exe
1976 RegSvcs.exe

pid	process
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe

description	pid	process	target process
PID 1584 set thread context of 1976	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3052 schtasks.exe

pid	process
3052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe

pid	process
1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe
1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe
1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe
1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe
1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe
Token: SeShutdownPrivilege	1976	RegSvcs.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

RegSvcs.exe

pid process

1976 RegSvcs.exe
1976 RegSvcs.exe

pid	process
1976	RegSvcs.exe
1976	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe

description	pid	process	target process
PID 1584 wrote to memory of 3052	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	schtasks.exe
PID 1584 wrote to memory of 3052	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	schtasks.exe
PID 1584 wrote to memory of 3052	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	schtasks.exe
PID 1584 wrote to memory of 844	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 844	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 844	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 2036	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 2036	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 2036	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 1976	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 1976	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 1976	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 1976	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 1976	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 1976	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 1976	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 1976	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 1976	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 1976	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe
PID 1584 wrote to memory of 1976	1584	f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe
"C:\Users\Admin\AppData\Local\Temp\f4c06b5a5e05514eae99a568da52d486cec115eceeff1b814217e60b845c0592.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\Ftkltg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp81AE.tmp"
2⤵
- Creates scheduled task(s)
PID:3052

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:2036

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp81AE.tmp

Filesize
1KB

MD5
1fa7082d654ed1d84c148889acfe3b06

SHA1
8f08d7e161bac7c6f33612b1b8bb380528fddb43

SHA256
a50871c244d1c562c46f0fab0eb3fdd7ca5141436c78c3625511704cee427a54

SHA512
40efa00c629e80c5ddcb58dc6f408237fe0848ca000994e9920f003ae2e3f3d6020d5f4f498b3bf97c5aead5679e6b7f89a748d1325a4c9813953e04e958ffcf

Download Submit
memory/844-140-0x0000000000000000-mapping.dmp

Download
memory/1584-136-0x00000000053A0000-0x00000000053AA000-memory.dmp

Filesize
40KB

Download
memory/1584-133-0x00000000052F0000-0x000000000538C000-memory.dmp

Filesize
624KB

Download
memory/1584-132-0x00000000003D0000-0x000000000094A000-memory.dmp

Filesize
5.5MB

Download
memory/1584-137-0x00000000054D0000-0x0000000005526000-memory.dmp

Filesize
344KB

Download
memory/1584-135-0x0000000005430000-0x00000000054C2000-memory.dmp

Filesize
584KB

Download
memory/1584-134-0x0000000005940000-0x0000000005EE4000-memory.dmp

Filesize
5.6MB

Download
memory/1976-149-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1976-148-0x0000000074D60000-0x0000000074D99000-memory.dmp

Filesize
228KB

Download
memory/1976-142-0x0000000000000000-mapping.dmp

Download
memory/1976-143-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1976-144-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1976-145-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1976-146-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1976-147-0x00000000749C0000-0x00000000749F9000-memory.dmp

Filesize
228KB

Download
memory/2036-141-0x0000000000000000-mapping.dmp

Download
memory/3052-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads