bitrat | 71c81318d16023aba7c537168d68b7d87eeeb085725d0904c3ea7298fc43d7e8

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

975d87e24e881a6d224d37b25a7c8a1d.exe
Size

1.7MB
MD5

975d87e24e881a6d224d37b25a7c8a1d
SHA1

836373fee93d77cf54eddc8c58a5b5fc2a6d259e
SHA256

71c81318d16023aba7c537168d68b7d87eeeb085725d0904c3ea7298fc43d7e8
SHA512

023291428628e04c9384b12ca4b2bc814b8bf81c713e00577eec17679d6b5de3f017838ff2b16f258553600678eec83f5f4972e8f9d9ab24eb7e969d26abfb35
SSDEEP

49152:+kI4ZpVNoNhRfKW7dAF1EnB0TSgCYp5HwG+uTiVkD+bV:+YZpVidZC/aB6ZpGXWD+bV

Score

10^/10

bitrat zgrat rat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

eter102.dvrlists.com:3050

Attributes

communication_password
fea0f7015af40ae69a386f06f28a8d31
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/1392-7-0x00000000008C0000-0x0000000000934000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-8-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-23-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-33-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-31-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-35-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-41-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-55-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-61-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-63-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-71-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-69-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-67-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-65-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-59-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-57-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-53-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-51-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-49-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-47-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-45-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-43-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-39-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-37-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-29-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-27-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-25-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-21-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-19-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-17-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-15-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-13-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-11-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1
behavioral1/memory/1392-9-0x00000000008C0000-0x000000000092F000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 2 IoCs

pid	Process
3068	RegAsm.exe
2124	RegAsm.exe

Loads dropped DLL 3 IoCs

pid	Process
1392	975d87e24e881a6d224d37b25a7c8a1d.exe
1392	975d87e24e881a6d224d37b25a7c8a1d.exe
2124	RegAsm.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2124-2348-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2124-2358-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2124	RegAsm.exe
2124	RegAsm.exe
2124	RegAsm.exe
2124	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1392 set thread context of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1392	975d87e24e881a6d224d37b25a7c8a1d.exe
1392	975d87e24e881a6d224d37b25a7c8a1d.exe
1392	975d87e24e881a6d224d37b25a7c8a1d.exe
1392	975d87e24e881a6d224d37b25a7c8a1d.exe
1392	975d87e24e881a6d224d37b25a7c8a1d.exe
1392	975d87e24e881a6d224d37b25a7c8a1d.exe
1860	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1392	975d87e24e881a6d224d37b25a7c8a1d.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	2124	RegAsm.exe
Token: SeShutdownPrivilege	2124	RegAsm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2124	RegAsm.exe
2124	RegAsm.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 2324	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	30
PID 1392 wrote to memory of 2324	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	30
PID 1392 wrote to memory of 2324	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	30
PID 1392 wrote to memory of 2324	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	30
PID 2324 wrote to memory of 1860	2324	WScript.exe	31
PID 2324 wrote to memory of 1860	2324	WScript.exe	31
PID 2324 wrote to memory of 1860	2324	WScript.exe	31
PID 2324 wrote to memory of 1860	2324	WScript.exe	31
PID 1392 wrote to memory of 3068	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	33
PID 1392 wrote to memory of 3068	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	33
PID 1392 wrote to memory of 3068	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	33
PID 1392 wrote to memory of 3068	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	33
PID 1392 wrote to memory of 3068	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	33
PID 1392 wrote to memory of 3068	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	33
PID 1392 wrote to memory of 3068	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	33
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	34
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	34
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	34
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	34
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	34
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	34
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	34
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	34
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	34
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	34
PID 1392 wrote to memory of 2124	1392	975d87e24e881a6d224d37b25a7c8a1d.exe	34

C:\Users\Admin\AppData\Local\Temp\975d87e24e881a6d224d37b25a7c8a1d.exe
"C:\Users\Admin\AppData\Local\Temp\975d87e24e881a6d224d37b25a7c8a1d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Npkbzalbimnyc.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\outlook.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
  C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
  C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_Npkbzalbimnyc.vbs

Filesize
175B

MD5
fe201b96b30ce7b044530dfc5659deac

SHA1
91886ecd3513af12147c4039f5f7c89a0a77fda7

SHA256
085219c444380891f8e66c4a7177cf148fb8309efcc353f61d8a590b9d06ac79

SHA512
1c2babdf1983450721f38fb5ae9b1544fa2a8060b2b6d367c86781faab8ef0777e9875470fca23e31cda983ed801e54dc2ce3d637a04c1f577f342439f7437ae

Download Submit
\Users\Admin\AppData\Local\Temp\RegAsm.exe

Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
memory/1392-0-0x00000000009F0000-0x0000000000BB2000-memory.dmp

Filesize
1.8MB

Download
memory/1392-1-0x00000000749F0000-0x00000000750DE000-memory.dmp

Filesize
6.9MB

Download
memory/1392-2-0x0000000004F40000-0x0000000004F80000-memory.dmp

Filesize
256KB

Download
memory/1392-3-0x0000000004F40000-0x0000000004F80000-memory.dmp

Filesize
256KB

Download
memory/1392-4-0x00000000749F0000-0x00000000750DE000-memory.dmp

Filesize
6.9MB

Download
memory/1392-5-0x0000000004F40000-0x0000000004F80000-memory.dmp

Filesize
256KB

Download
memory/1392-6-0x0000000005200000-0x00000000053AE000-memory.dmp

Filesize
1.7MB

Download
memory/1392-7-0x00000000008C0000-0x0000000000934000-memory.dmp

Filesize
464KB

Download
memory/1392-8-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-23-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-33-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-31-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-35-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-41-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-55-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-61-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-63-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-71-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-69-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-67-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-65-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-59-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-57-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-53-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-51-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-49-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-47-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-45-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-43-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-39-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-37-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-29-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-27-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-25-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-21-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-19-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-17-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-15-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-13-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-11-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-9-0x00000000008C0000-0x000000000092F000-memory.dmp

Filesize
444KB

Download
memory/1392-1179-0x0000000004F40000-0x0000000004F80000-memory.dmp

Filesize
256KB

Download
memory/1392-2339-0x00000000749F0000-0x00000000750DE000-memory.dmp

Filesize
6.9MB

Download
memory/1860-2343-0x000000006F630000-0x000000006FBDB000-memory.dmp

Filesize
5.7MB

Download
memory/1860-2344-0x0000000002AC0000-0x0000000002B00000-memory.dmp

Filesize
256KB

Download
memory/1860-2345-0x000000006F630000-0x000000006FBDB000-memory.dmp

Filesize
5.7MB

Download
memory/1860-2346-0x0000000002AC0000-0x0000000002B00000-memory.dmp

Filesize
256KB

Download
memory/1860-2347-0x0000000002AC0000-0x0000000002B00000-memory.dmp

Filesize
256KB

Download
memory/1860-2349-0x000000006F630000-0x000000006FBDB000-memory.dmp

Filesize
5.7MB

Download
memory/2124-2348-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2124-2358-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download