bitrat | e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b

General

Target

e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
Size

3.5MB
MD5

2a91c21bfc56a4fd93f7efa57724a759
SHA1

3c488f16cebbe8454fb490a9305eed8b7ae9eeba
SHA256

e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b
SHA512

2f4b8f7c5b7192da4706a8986943d047af18534320502f74aff3d9ff8c34c3632c238be16c25e6e2ecd4b67cc38954b0b5948e0351a21c4948224e99a1b0fbea
SSDEEP

98304:p4GcmSFQwfd3TyjJPLOzvSjmDXGT48tcf5MP:p4GP+Qy5TyizveAXGU8tcf5A

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.34

C2

37.120.208.46:1973

Attributes

communication_password
f49a6667c09a9e329afb64bc0a18a188
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe

pid	process
1808	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
1808	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
1808	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
1808	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe

description	pid	process	target process
PID 2028 set thread context of 1808	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1424 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe

pid process

2028 e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe

pid	process
1424	schtasks.exe

pid	process
2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exee76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe

description	pid	process
Token: SeDebugPrivilege	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
Token: SeDebugPrivilege	1808	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
Token: SeShutdownPrivilege	1808	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe

pid	process
1808	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
1808	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe

C:\Users\Admin\AppData\Local\Temp\e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
"C:\Users\Admin\AppData\Local\Temp\e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TTTLaduORnb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6807.tmp"
2⤵
- Creates scheduled task(s)
PID:1424

C:\Users\Admin\AppData\Local\Temp\e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
"{path}"
2⤵
PID:1884

C:\Users\Admin\AppData\Local\Temp\e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
"{path}"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6807.tmp

Filesize
1KB

MD5
c7acaea98247a33007363e1b9438eb92

SHA1
5d183b6ba043f2dd08c040e98c35ae840205edca

SHA256
3015b66bba5e2da1cb66edbb6cf5836ed03e08077fca6b7e71f816aea9f69cb2

SHA512
33b4bd32c946464c3a01ba12c5ae5cb1d74524d778af18d5ad4b54e3ddb4b92c399d1928cc5bed46383b1ede227e2f7578b75c384fe933dd6a80cdb4690a7f9e

Download Submit
memory/1424-57-0x0000000000000000-mapping.dmp

Download
memory/1808-64-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1808-66-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1808-77-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1808-59-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1808-60-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1808-62-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1808-75-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1808-72-0x0000000000689A84-mapping.dmp

Download
memory/1808-68-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1808-69-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1808-71-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/2028-56-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download
memory/2028-74-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download
memory/2028-54-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/2028-55-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download

description	pid	process	target process
PID 2028 wrote to memory of 1424	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	schtasks.exe
PID 2028 wrote to memory of 1424	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	schtasks.exe
PID 2028 wrote to memory of 1424	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	schtasks.exe
PID 2028 wrote to memory of 1424	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	schtasks.exe
PID 2028 wrote to memory of 1884	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
PID 2028 wrote to memory of 1884	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
PID 2028 wrote to memory of 1884	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
PID 2028 wrote to memory of 1884	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
PID 2028 wrote to memory of 1808	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
PID 2028 wrote to memory of 1808	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
PID 2028 wrote to memory of 1808	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
PID 2028 wrote to memory of 1808	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
PID 2028 wrote to memory of 1808	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
PID 2028 wrote to memory of 1808	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
PID 2028 wrote to memory of 1808	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
PID 2028 wrote to memory of 1808	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
PID 2028 wrote to memory of 1808	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
PID 2028 wrote to memory of 1808	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
PID 2028 wrote to memory of 1808	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe
PID 2028 wrote to memory of 1808	2028	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe	e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads