bitrat | 1972ef1673d32236f0c87e52ddab2d5472af789e6de1d70ccd22c4cdf4839e54

General

Target

1986c381aa62399f7e9d0b78e220d251.exe
Size

2.0MB
MD5

1986c381aa62399f7e9d0b78e220d251
SHA1

619700a00961904426b5ecae5b344f753315738d
SHA256

1972ef1673d32236f0c87e52ddab2d5472af789e6de1d70ccd22c4cdf4839e54
SHA512

f1b7baf0576aa873c59bd0dc2eac11d297b6c1d8b6080ca99dcff694338049f09ddb66970a55a327800cbb7855b25d5548d4669426732761bd81991d478d1f15
SSDEEP

49152:AYvMRWsoJqFYqKRd5AyM3xSa3jBSWC7NjPi9F+w:A9RYJqFYFxAbBSa3jAXj9w

Score

10^/10

bitrat persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

89.248.173.187:5506

Attributes

communication_password
fcea920f7412b5da7be0cf42b8c93759
install_dir
sazpclv
install_file
wmzr.exe
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1986c381aa62399f7e9d0b78e220d251.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\wmzr = "C:\\Users\\Admin\\AppData\\Local\\sazpclv\\wmzr.exe"	1986c381aa62399f7e9d0b78e220d251.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

1986c381aa62399f7e9d0b78e220d251.exe

pid	process
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1986c381aa62399f7e9d0b78e220d251.exe

description pid process target process

PID 2248 set thread context of 1540 2248 1986c381aa62399f7e9d0b78e220d251.exe 1986c381aa62399f7e9d0b78e220d251.exe

description	pid	process	target process
PID 2248 set thread context of 1540	2248	1986c381aa62399f7e9d0b78e220d251.exe	1986c381aa62399f7e9d0b78e220d251.exe

Suspicious behavior: RenamesItself 28 IoCs

Processes:

1986c381aa62399f7e9d0b78e220d251.exe

pid	process
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe
1540	1986c381aa62399f7e9d0b78e220d251.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1986c381aa62399f7e9d0b78e220d251.exe

description	pid	process
Token: SeDebugPrivilege	1540	1986c381aa62399f7e9d0b78e220d251.exe
Token: SeShutdownPrivilege	1540	1986c381aa62399f7e9d0b78e220d251.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

1986c381aa62399f7e9d0b78e220d251.exe

pid process

1540 1986c381aa62399f7e9d0b78e220d251.exe
1540 1986c381aa62399f7e9d0b78e220d251.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

1986c381aa62399f7e9d0b78e220d251.exe

description	pid	process	target process
PID 2248 wrote to memory of 1540	2248	1986c381aa62399f7e9d0b78e220d251.exe	1986c381aa62399f7e9d0b78e220d251.exe
PID 2248 wrote to memory of 1540	2248	1986c381aa62399f7e9d0b78e220d251.exe	1986c381aa62399f7e9d0b78e220d251.exe
PID 2248 wrote to memory of 1540	2248	1986c381aa62399f7e9d0b78e220d251.exe	1986c381aa62399f7e9d0b78e220d251.exe
PID 2248 wrote to memory of 1540	2248	1986c381aa62399f7e9d0b78e220d251.exe	1986c381aa62399f7e9d0b78e220d251.exe
PID 2248 wrote to memory of 1540	2248	1986c381aa62399f7e9d0b78e220d251.exe	1986c381aa62399f7e9d0b78e220d251.exe
PID 2248 wrote to memory of 1540	2248	1986c381aa62399f7e9d0b78e220d251.exe	1986c381aa62399f7e9d0b78e220d251.exe
PID 2248 wrote to memory of 1540	2248	1986c381aa62399f7e9d0b78e220d251.exe	1986c381aa62399f7e9d0b78e220d251.exe
PID 2248 wrote to memory of 1540	2248	1986c381aa62399f7e9d0b78e220d251.exe	1986c381aa62399f7e9d0b78e220d251.exe
PID 2248 wrote to memory of 1540	2248	1986c381aa62399f7e9d0b78e220d251.exe	1986c381aa62399f7e9d0b78e220d251.exe
PID 2248 wrote to memory of 1540	2248	1986c381aa62399f7e9d0b78e220d251.exe	1986c381aa62399f7e9d0b78e220d251.exe
PID 2248 wrote to memory of 1540	2248	1986c381aa62399f7e9d0b78e220d251.exe	1986c381aa62399f7e9d0b78e220d251.exe
PID 2248 wrote to memory of 1540	2248	1986c381aa62399f7e9d0b78e220d251.exe	1986c381aa62399f7e9d0b78e220d251.exe

C:\Users\Admin\AppData\Local\Temp\1986c381aa62399f7e9d0b78e220d251.exe
"C:\Users\Admin\AppData\Local\Temp\1986c381aa62399f7e9d0b78e220d251.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2248

C:\Users\Admin\AppData\Local\Temp\1986c381aa62399f7e9d0b78e220d251.exe
"C:\Users\Admin\AppData\Local\Temp\1986c381aa62399f7e9d0b78e220d251.exe"
2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1540-23-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-30-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-20-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-21-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-5-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-9-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-8-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-45-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-10-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-13-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-17-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-16-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-15-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-11-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-18-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-19-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-44-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-43-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1540-24-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-25-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-26-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-27-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-28-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-31-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-41-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-32-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-35-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-36-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-37-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-39-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1540-40-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2248-0-0x00000000047F0000-0x00000000049D4000-memory.dmp

Filesize
1.9MB

Download
memory/2248-4-0x00000000049E0000-0x0000000004DA5000-memory.dmp

Filesize
3.8MB

Download
memory/2248-1-0x00000000047F0000-0x00000000049D4000-memory.dmp

Filesize
1.9MB

Download
memory/2248-7-0x00000000047F0000-0x00000000049D4000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads