bitrat | 24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186

General

Target

24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
Size

10KB
MD5

9c21d2bd9e8db420cd94a03a00dfdba4
SHA1

2f90b847dda5638552a3a5fb01ee28ea6bf82245
SHA256

24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186
SHA512

58e4a7c75b41b8551bec5085bc6148ea58c1873981dd6e872b261037d34b15b5ffeccb5babbcb9d756702cccab257a6ebd4c3e9394b843d7b9f94f8a204ab8a6
SSDEEP

96:fPdkus9rUrOeM+Jn2JUHBOYOlkIy6KUwTTgJMRqI6ruuuVFr3333KnpMwKFnU:fP29rUrBM82YjOeJ1TTgJMRqIcuuu6/

Score

10^/10

bitrat persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

37.139.128.233:3569

Attributes

communication_password
ce952068942604a6d6df06ed5002fad6
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qkvjuzfcbq = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gvfbdj\\Qkvjuzfcbq.exe\""	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

pid	process
920	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
920	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
920	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
920	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
920	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

description	pid	process	target process
PID 808 set thread context of 920	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exe24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

pid	process
1992	powershell.exe
1992	powershell.exe
808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exepowershell.exe24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

description	pid	process
Token: SeDebugPrivilege	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeShutdownPrivilege	920	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

pid	process
920	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
920	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

C:\Users\Admin\AppData\Local\Temp\24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
"C:\Users\Admin\AppData\Local\Temp\24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAyAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Users\Admin\AppData\Local\Temp\24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
C:\Users\Admin\AppData\Local\Temp\24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
2⤵
PID:2852

C:\Users\Admin\AppData\Local\Temp\24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
C:\Users\Admin\AppData\Local\Temp\24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-132-0x0000000000340000-0x0000000000348000-memory.dmp

Filesize
32KB

Download
memory/808-133-0x0000000006D40000-0x0000000006DD2000-memory.dmp

Filesize
584KB

Download
memory/808-134-0x0000000007390000-0x0000000007934000-memory.dmp

Filesize
5.6MB

Download
memory/808-135-0x0000000006D10000-0x0000000006D32000-memory.dmp

Filesize
136KB

Download
memory/920-154-0x0000000074ED0000-0x0000000074F09000-memory.dmp

Filesize
228KB

Download
memory/920-156-0x0000000074ED0000-0x0000000074F09000-memory.dmp

Filesize
228KB

Download
memory/920-157-0x0000000074ED0000-0x0000000074F09000-memory.dmp

Filesize
228KB

Download
memory/920-155-0x0000000074B50000-0x0000000074B89000-memory.dmp

Filesize
228KB

Download
memory/920-149-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/920-153-0x0000000074ED0000-0x0000000074F09000-memory.dmp

Filesize
228KB

Download
memory/920-152-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/920-151-0x0000000074ED0000-0x0000000074F09000-memory.dmp

Filesize
228KB

Download
memory/920-150-0x0000000074B50000-0x0000000074B89000-memory.dmp

Filesize
228KB

Download
memory/920-145-0x0000000000000000-mapping.dmp

Download
memory/920-146-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/920-147-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/920-148-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1992-138-0x0000000005110000-0x0000000005738000-memory.dmp

Filesize
6.2MB

Download
memory/1992-143-0x0000000006440000-0x000000000645A000-memory.dmp

Filesize
104KB

Download
memory/1992-142-0x0000000007790000-0x0000000007E0A000-memory.dmp

Filesize
6.5MB

Download
memory/1992-141-0x0000000005F40000-0x0000000005F5E000-memory.dmp

Filesize
120KB

Download
memory/1992-140-0x0000000005820000-0x0000000005886000-memory.dmp

Filesize
408KB

Download
memory/1992-139-0x00000000057B0000-0x0000000005816000-memory.dmp

Filesize
408KB

Download
memory/1992-137-0x00000000049C0000-0x00000000049F6000-memory.dmp

Filesize
216KB

Download
memory/1992-136-0x0000000000000000-mapping.dmp

Download
memory/2852-144-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 808 wrote to memory of 1992	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	powershell.exe
PID 808 wrote to memory of 1992	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	powershell.exe
PID 808 wrote to memory of 1992	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	powershell.exe
PID 808 wrote to memory of 2852	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
PID 808 wrote to memory of 2852	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
PID 808 wrote to memory of 2852	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
PID 808 wrote to memory of 920	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
PID 808 wrote to memory of 920	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
PID 808 wrote to memory of 920	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
PID 808 wrote to memory of 920	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
PID 808 wrote to memory of 920	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
PID 808 wrote to memory of 920	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
PID 808 wrote to memory of 920	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
PID 808 wrote to memory of 920	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
PID 808 wrote to memory of 920	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
PID 808 wrote to memory of 920	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe
PID 808 wrote to memory of 920	808	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe	24fe6412893abef12251d0c0cb59beaf40cdc34ce8c70ff766e4d9444a6f6186.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads