bitrat | b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd

General

Target

b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe
Size

5.0MB
MD5

89c51019b03c22388a5cde47dd1529ec
SHA1

c5734ca43306e8c84d10bc6f259c75f43255720a
SHA256

b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd
SHA512

bd7b1e7d0dfb0639f66e6c8f3151b0e96c4107b7e6babf0a3e9e13ae1e668967deeb32408508311e9d84224af5fbd91070bd5f24d8c55c6d734efbf5b3dfe30f
SSDEEP

98304:0GQfVpTU4CxukRPMwMMD5KFPcldTkLSRHhyn5FwR+OJ1IH5iL1EauPw1z:XWHEJRd7YUdCSryn7yIwF6+

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.34

C2

185.157.162.234:54262

Attributes

communication_password
2bb232c0b13c774965ef8558f0fbd615
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

RegSvcs.exe

pid process

1840 RegSvcs.exe
1840 RegSvcs.exe
1840 RegSvcs.exe
1840 RegSvcs.exe

pid	process
1840	RegSvcs.exe
1840	RegSvcs.exe
1840	RegSvcs.exe
1840	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe

description	pid	process	target process
PID 1488 set thread context of 1840	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4304 schtasks.exe

pid	process
4304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe

pid	process
1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe
1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe
1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe
Token: SeShutdownPrivilege	1840	RegSvcs.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

RegSvcs.exe

pid process

1840 RegSvcs.exe
1840 RegSvcs.exe

pid	process
1840	RegSvcs.exe
1840	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe

description	pid	process	target process
PID 1488 wrote to memory of 4304	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	schtasks.exe
PID 1488 wrote to memory of 4304	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	schtasks.exe
PID 1488 wrote to memory of 4304	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	schtasks.exe
PID 1488 wrote to memory of 1496	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	RegSvcs.exe
PID 1488 wrote to memory of 1496	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	RegSvcs.exe
PID 1488 wrote to memory of 1496	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	RegSvcs.exe
PID 1488 wrote to memory of 1840	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	RegSvcs.exe
PID 1488 wrote to memory of 1840	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	RegSvcs.exe
PID 1488 wrote to memory of 1840	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	RegSvcs.exe
PID 1488 wrote to memory of 1840	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	RegSvcs.exe
PID 1488 wrote to memory of 1840	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	RegSvcs.exe
PID 1488 wrote to memory of 1840	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	RegSvcs.exe
PID 1488 wrote to memory of 1840	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	RegSvcs.exe
PID 1488 wrote to memory of 1840	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	RegSvcs.exe
PID 1488 wrote to memory of 1840	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	RegSvcs.exe
PID 1488 wrote to memory of 1840	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	RegSvcs.exe
PID 1488 wrote to memory of 1840	1488	b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe
"C:\Users\Admin\AppData\Local\Temp\b13c23ba543d6cc3be5193435fa78b265ee98904ea2ad37f7922904cc5092cdd.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RgKuObYJRjVYK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2A47.tmp"
2⤵
- Creates scheduled task(s)
PID:4304

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:1496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1840

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2A47.tmp
Filesize
1KB

MD5
b803451044b4525bfe28c58fa69cc7d4

SHA1
9a91d443dce51d0393dccdda9eb4f9ad9e523e5f

SHA256
f584ed25d24c759b7cbe78a7762717c141bdaf2c07ef0fad5ce8c730ad8dd7e0

SHA512
db56d92e39085dfcb8868413593df07881660e108d817dfd26fc330d68da4586f99927288f2ebbdc49badcdd96f6ffd48e112e7e5a90699291d382ab6e29a375

Download Submit
memory/1488-133-0x0000000005D50000-0x0000000005DEC000-memory.dmp

Filesize
624KB

Download
memory/1488-134-0x0000000006410000-0x00000000069B4000-memory.dmp

Filesize
5.6MB

Download
memory/1488-135-0x0000000005F00000-0x0000000005F92000-memory.dmp

Filesize
584KB

Download
memory/1488-136-0x0000000005E40000-0x0000000005E4A000-memory.dmp

Filesize
40KB

Download
memory/1488-137-0x00000000060E0000-0x0000000006136000-memory.dmp

Filesize
344KB

Download
memory/1488-132-0x0000000000EF0000-0x00000000013F6000-memory.dmp

Filesize
5.0MB

Download
memory/1496-140-0x0000000000000000-mapping.dmp

Download
memory/1840-141-0x0000000000000000-mapping.dmp

Download
memory/1840-142-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1840-143-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1840-144-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1840-145-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1840-146-0x0000000074970000-0x00000000749A9000-memory.dmp

Filesize
228KB

Download
memory/1840-147-0x0000000074CF0000-0x0000000074D29000-memory.dmp

Filesize
228KB

Download
memory/1840-148-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1840-149-0x0000000074CF0000-0x0000000074D29000-memory.dmp

Filesize
228KB

Download
memory/4304-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads