bitrat | 71c81318d16023aba7c537168d68b7d87eeeb085725d0904c3ea7298fc43d7e8

General

Target

975d87e24e881a6d224d37b25a7c8a1d.exe
Size

1.7MB
MD5

975d87e24e881a6d224d37b25a7c8a1d
SHA1

836373fee93d77cf54eddc8c58a5b5fc2a6d259e
SHA256

71c81318d16023aba7c537168d68b7d87eeeb085725d0904c3ea7298fc43d7e8
SHA512

023291428628e04c9384b12ca4b2bc814b8bf81c713e00577eec17679d6b5de3f017838ff2b16f258553600678eec83f5f4972e8f9d9ab24eb7e969d26abfb35
SSDEEP

49152:+kI4ZpVNoNhRfKW7dAF1EnB0TSgCYp5HwG+uTiVkD+bV:+YZpVidZC/aB6ZpGXWD+bV

Score

10^/10

bitrat zgrat rat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

eter102.dvrlists.com:3050

Attributes

communication_password
fea0f7015af40ae69a386f06f28a8d31
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1392-7-0x00000000008C0000-0x0000000000934000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-8-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-23-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-33-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-31-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-35-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-41-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-55-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-61-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-63-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-71-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-69-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-67-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-65-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-59-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-57-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-53-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-51-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-49-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-47-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-45-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-43-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-39-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-37-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-29-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-27-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-25-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-21-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-19-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-17-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-15-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-13-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-11-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-9-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Executes dropped EXE 2 IoCs

Processes:

RegAsm.exeRegAsm.exe

pid process

3068 RegAsm.exe
2124 RegAsm.exe
Loads dropped DLL 3 IoCs

Processes:

975d87e24e881a6d224d37b25a7c8a1d.exeRegAsm.exe

pid process

1392 975d87e24e881a6d224d37b25a7c8a1d.exe
1392 975d87e24e881a6d224d37b25a7c8a1d.exe
2124 RegAsm.exe

pid	process
3068	RegAsm.exe
2124	RegAsm.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2124-2348-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2124-2358-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

RegAsm.exe

pid process

2124 RegAsm.exe
2124 RegAsm.exe
2124 RegAsm.exe
2124 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

975d87e24e881a6d224d37b25a7c8a1d.exe

description pid process target process

PID 1392 set thread context of 2124 1392 975d87e24e881a6d224d37b25a7c8a1d.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2124	RegAsm.exe
2124	RegAsm.exe
2124	RegAsm.exe
2124	RegAsm.exe

description	pid	process	target process
PID 1392 set thread context of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

975d87e24e881a6d224d37b25a7c8a1d.exepowershell.exe

pid	process
1392	975d87e24e881a6d224d37b25a7c8a1d.exe
1392	975d87e24e881a6d224d37b25a7c8a1d.exe
1392	975d87e24e881a6d224d37b25a7c8a1d.exe
1392	975d87e24e881a6d224d37b25a7c8a1d.exe
1392	975d87e24e881a6d224d37b25a7c8a1d.exe
1392	975d87e24e881a6d224d37b25a7c8a1d.exe
1860	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

975d87e24e881a6d224d37b25a7c8a1d.exepowershell.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1392	975d87e24e881a6d224d37b25a7c8a1d.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	2124	RegAsm.exe
Token: SeShutdownPrivilege	2124	RegAsm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

RegAsm.exe

pid process

2124 RegAsm.exe
2124 RegAsm.exe

pid	process
2124	RegAsm.exe
2124	RegAsm.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

975d87e24e881a6d224d37b25a7c8a1d.exeWScript.exe

description	pid	process	target process
PID 1392 wrote to memory of 2324	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	WScript.exe
PID 1392 wrote to memory of 2324	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	WScript.exe
PID 1392 wrote to memory of 2324	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	WScript.exe
PID 1392 wrote to memory of 2324	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	WScript.exe
PID 2324 wrote to memory of 1860	2324	WScript.exe	powershell.exe
PID 2324 wrote to memory of 1860	2324	WScript.exe	powershell.exe
PID 2324 wrote to memory of 1860	2324	WScript.exe	powershell.exe
PID 2324 wrote to memory of 1860	2324	WScript.exe	powershell.exe
PID 1392 wrote to memory of 3068	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 3068	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 3068	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 3068	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 3068	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 3068	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 3068	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\975d87e24e881a6d224d37b25a7c8a1d.exe
"C:\Users\Admin\AppData\Local\Temp\975d87e24e881a6d224d37b25a7c8a1d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Npkbzalbimnyc.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\outlook.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
2⤵
- Executes dropped EXE
PID:3068

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2124

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_Npkbzalbimnyc.vbs
Filesize
175B

MD5
fe201b96b30ce7b044530dfc5659deac

SHA1
91886ecd3513af12147c4039f5f7c89a0a77fda7

SHA256
085219c444380891f8e66c4a7177cf148fb8309efcc353f61d8a590b9d06ac79

SHA512
1c2babdf1983450721f38fb5ae9b1544fa2a8060b2b6d367c86781faab8ef0777e9875470fca23e31cda983ed801e54dc2ce3d637a04c1f577f342439f7437ae

Download Submit
\Users\Admin\AppData\Local\Temp\RegAsm.exe
Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
memory/1392-0-0x00000000009F0000-0x0000000000BB2000-memory.dmp

Filesize
1.8MB

Download
memory/1392-1-0x00000000749F0000-0x00000000750DE000-memory.dmp

Filesize
6.9MB

Download
memory/1392-2-0x0000000004F40000-0x0000000004F80000-memory.dmp

Filesize
256KB

Download
memory/1392-3-0x0000000004F40000-0x0000000004F80000-memory.dmp

Filesize
256KB

Download
memory/1392-4-0x00000000749F0000-0x00000000750DE000-memory.dmp

Filesize
6.9MB

Download
memory/1392-5-0x0000000004F40000-0x0000000004F80000-memory.dmp

Filesize
256KB

Download
memory/1392-6-0x0000000005200000-0x00000000053AE000-memory.dmp

Filesize
1.7MB

Download
memory/1392-7-0x00000000008C0000-0x0000000000934000-memory.dmp

Filesize
464KB

Download
memory/1392-8-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-23-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-33-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-31-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-35-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-41-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-55-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-61-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-63-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-71-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-69-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-67-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-65-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-59-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-57-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-53-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-51-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-49-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-47-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-45-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-43-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-39-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-37-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-29-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-27-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-25-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-21-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-19-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-17-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-15-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-13-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-11-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-9-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-1179-0x0000000004F40000-0x0000000004F80000-memory.dmp

Filesize
256KB

Download
memory/1392-2339-0x00000000749F0000-0x00000000750DE000-memory.dmp

Filesize
6.9MB

Download
memory/1860-2343-0x000000006F630000-0x000000006FBDB000-memory.dmp

Filesize
5.7MB

Download
memory/1860-2344-0x0000000002AC0000-0x0000000002B00000-memory.dmp

Filesize
256KB

Download
memory/1860-2345-0x000000006F630000-0x000000006FBDB000-memory.dmp

Filesize
5.7MB

Download
memory/1860-2346-0x0000000002AC0000-0x0000000002B00000-memory.dmp

Filesize
256KB

Download
memory/1860-2347-0x0000000002AC0000-0x0000000002B00000-memory.dmp

Filesize
256KB

Download
memory/1860-2349-0x000000006F630000-0x000000006FBDB000-memory.dmp

Filesize
5.7MB

Download
memory/2124-2348-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2124-2358-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads