bitrat | 29dd2b13f081a0c7f8312c4b4c433ccdcc3b3a83b91a16a88393370dda44f60b

General

Target

2ab11c37b84f87c8f05bbd7997648e63.exe
Size

1.7MB
MD5

2ab11c37b84f87c8f05bbd7997648e63
SHA1

317b103a0b4cb143a1e26a46f15c550850f46645
SHA256

29dd2b13f081a0c7f8312c4b4c433ccdcc3b3a83b91a16a88393370dda44f60b
SHA512

782ba79e5f521968cc596c091e29a1d9d55c4a91488bbcfb1eb463850a405d9e3ebc09da08c5002c415a68f30f19e3654ccdf23274f4f9b004a254da25d41d02
SSDEEP

49152:vS4/sAt6LKa0qrxt0fHuv4B9ZKOZLNk+ZgXFebV:Hrqroi6ZjLmwbV

Score

10^/10

bitrat zgrat rat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

eter102.dvrlists.com:3050

Attributes

communication_password
fea0f7015af40ae69a386f06f28a8d31
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2004-5-0x0000000000DC0000-0x0000000000E28000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-6-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-7-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-11-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-9-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-13-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-15-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-17-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-19-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-21-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-23-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-25-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-27-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-29-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-33-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-35-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-31-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-37-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-39-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-41-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-43-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-45-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-47-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-49-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-57-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-59-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-55-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-53-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-61-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-51-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-63-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-65-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-67-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-69-0x0000000000DC0000-0x0000000000E22000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Executes dropped EXE 1 IoCs

Processes:

RegAsm.exe

pid process

2264 RegAsm.exe
Loads dropped DLL 2 IoCs

Processes:

2ab11c37b84f87c8f05bbd7997648e63.exeRegAsm.exe

pid process

2004 2ab11c37b84f87c8f05bbd7997648e63.exe
2264 RegAsm.exe

pid	process
2264	RegAsm.exe

pid	process
2004	2ab11c37b84f87c8f05bbd7997648e63.exe
2264	RegAsm.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2264-1980-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2264-1998-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

RegAsm.exe

pid process

2264 RegAsm.exe
2264 RegAsm.exe
2264 RegAsm.exe
2264 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

2ab11c37b84f87c8f05bbd7997648e63.exe

description pid process target process

PID 2004 set thread context of 2264 2004 2ab11c37b84f87c8f05bbd7997648e63.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

2ab11c37b84f87c8f05bbd7997648e63.exepowershell.exe

pid process

2004 2ab11c37b84f87c8f05bbd7997648e63.exe
2004 2ab11c37b84f87c8f05bbd7997648e63.exe
2644 powershell.exe

pid	process
2264	RegAsm.exe
2264	RegAsm.exe
2264	RegAsm.exe
2264	RegAsm.exe

description	pid	process	target process
PID 2004 set thread context of 2264	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	RegAsm.exe

pid	process
2004	2ab11c37b84f87c8f05bbd7997648e63.exe
2004	2ab11c37b84f87c8f05bbd7997648e63.exe
2644	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

2ab11c37b84f87c8f05bbd7997648e63.exepowershell.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2004	2ab11c37b84f87c8f05bbd7997648e63.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	2264	RegAsm.exe
Token: SeShutdownPrivilege	2264	RegAsm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

RegAsm.exe

pid process

2264 RegAsm.exe
2264 RegAsm.exe

pid	process
2264	RegAsm.exe
2264	RegAsm.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

2ab11c37b84f87c8f05bbd7997648e63.exeWScript.exe

description	pid	process	target process
PID 2004 wrote to memory of 2684	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	WScript.exe
PID 2004 wrote to memory of 2684	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	WScript.exe
PID 2004 wrote to memory of 2684	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	WScript.exe
PID 2004 wrote to memory of 2684	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	WScript.exe
PID 2004 wrote to memory of 2264	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	RegAsm.exe
PID 2004 wrote to memory of 2264	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	RegAsm.exe
PID 2004 wrote to memory of 2264	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	RegAsm.exe
PID 2004 wrote to memory of 2264	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	RegAsm.exe
PID 2004 wrote to memory of 2264	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	RegAsm.exe
PID 2004 wrote to memory of 2264	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	RegAsm.exe
PID 2004 wrote to memory of 2264	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	RegAsm.exe
PID 2004 wrote to memory of 2264	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	RegAsm.exe
PID 2004 wrote to memory of 2264	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	RegAsm.exe
PID 2684 wrote to memory of 2644	2684	WScript.exe	powershell.exe
PID 2684 wrote to memory of 2644	2684	WScript.exe	powershell.exe
PID 2684 wrote to memory of 2644	2684	WScript.exe	powershell.exe
PID 2684 wrote to memory of 2644	2684	WScript.exe	powershell.exe
PID 2004 wrote to memory of 2264	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	RegAsm.exe
PID 2004 wrote to memory of 2264	2004	2ab11c37b84f87c8f05bbd7997648e63.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\2ab11c37b84f87c8f05bbd7997648e63.exe
"C:\Users\Admin\AppData\Local\Temp\2ab11c37b84f87c8f05bbd7997648e63.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Curxdeconfrdsjimvavaanw.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\outlook.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_Curxdeconfrdsjimvavaanw.vbs
Filesize
175B

MD5
fe201b96b30ce7b044530dfc5659deac

SHA1
91886ecd3513af12147c4039f5f7c89a0a77fda7

SHA256
085219c444380891f8e66c4a7177cf148fb8309efcc353f61d8a590b9d06ac79

SHA512
1c2babdf1983450721f38fb5ae9b1544fa2a8060b2b6d367c86781faab8ef0777e9875470fca23e31cda983ed801e54dc2ce3d637a04c1f577f342439f7437ae

Download Submit
\Users\Admin\AppData\Local\Temp\RegAsm.exe
Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
memory/2004-41-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-65-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-4-0x0000000008240000-0x00000000083E8000-memory.dmp

Filesize
1.7MB

Download
memory/2004-5-0x0000000000DC0000-0x0000000000E28000-memory.dmp

Filesize
416KB

Download
memory/2004-6-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-7-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-11-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-9-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-13-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-15-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-17-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-19-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-21-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-23-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-25-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-27-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-29-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-33-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-35-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-31-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-37-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-39-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-0-0x0000000000E30000-0x0000000000FEA000-memory.dmp

Filesize
1.7MB

Download
memory/2004-43-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-57-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-47-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-49-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-45-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-59-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-55-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-53-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-61-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-51-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-63-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-3-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2004-67-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-69-0x0000000000DC0000-0x0000000000E22000-memory.dmp

Filesize
392KB

Download
memory/2004-2-0x0000000004D40000-0x0000000004D80000-memory.dmp

Filesize
256KB

Download
memory/2004-1-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2004-1975-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2264-1980-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2264-1998-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2644-1985-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-1986-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-1987-0x0000000002220000-0x0000000002260000-memory.dmp

Filesize
256KB

Download
memory/2644-1988-0x0000000002220000-0x0000000002260000-memory.dmp

Filesize
256KB

Download
memory/2644-1997-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads