bitrat | bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49

General

Target

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
Size

30KB
MD5

ffe58002561c927433fb391a123c9f23
SHA1

7b8d97cef22c86e4c514b78d9ac529357c98d4d3
SHA256

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49
SHA512

8b7288ac5c2f10ebd1c4cfa9f92ae12aa2ebd6dd78b0693d00052b1725246b420fa79c2282c9768a66aef3cec699fd482fda9bdfaef9acac1f1dcdaae24c2a2e
SSDEEP

384:r3O6DXJnbUXZ5MPQWs5tYnhqsXHJfOroDsyGVOSmUpLlcw7Kk0fyfm4klrHByS:yisvLMpfOroDsZVA6Llcw7fAyfmxZ

Score

10^/10

bitrat zgrat persistence rat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

103.153.182.247:6161

Attributes

communication_password
81dc9bdb52d04dc20036dbd8313ed055
install_dir
Install path
install_file
Install name
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3644-3-0x0000000006240000-0x0000000006624000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-4-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-5-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-7-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-9-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-11-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-13-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-15-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-17-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-19-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-21-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-23-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-25-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-27-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-29-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-31-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-33-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-35-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-37-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-39-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-41-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-43-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-45-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-47-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-49-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-51-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-53-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-55-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-57-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-59-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-61-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-63-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-65-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1
behavioral1/memory/3644-67-0x0000000006240000-0x000000000661F000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Drops startup file 1 IoCs

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ujqqnhnbwgz.vbs	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Install name = "C:\\Users\\Admin\\AppData\\Local\\Install path\\Install name"	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Install name = "C:\\Users\\Admin\\AppData\\Local\\Install path\\Install nameȀ"	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

pid	process
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

description	pid	process	target process
PID 3644 set thread context of 3880	3644	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

Suspicious behavior: RenamesItself 11 IoCs

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

pid	process
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exebfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

description	pid	process
Token: SeDebugPrivilege	3644	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
Token: SeDebugPrivilege	3644	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
Token: SeShutdownPrivilege	3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

pid	process
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
3880	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

description	pid	process	target process
PID 3644 wrote to memory of 3880	3644	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 3644 wrote to memory of 3880	3644	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 3644 wrote to memory of 3880	3644	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 3644 wrote to memory of 3880	3644	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 3644 wrote to memory of 3880	3644	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 3644 wrote to memory of 3880	3644	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 3644 wrote to memory of 3880	3644	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 3644 wrote to memory of 3880	3644	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 3644 wrote to memory of 3880	3644	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 3644 wrote to memory of 3880	3644	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 3644 wrote to memory of 3880	3644	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

C:\Users\Admin\AppData\Local\Temp\bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
"C:\Users\Admin\AppData\Local\Temp\bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3644

C:\Users\Admin\AppData\Local\Temp\bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
"C:\Users\Admin\AppData\Local\Temp\bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe"
2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3880

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3644-0-0x0000000000EC0000-0x0000000000ECE000-memory.dmp

Filesize
56KB

Download
memory/3644-1-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/3644-2-0x00000000059B0000-0x00000000059C0000-memory.dmp

Filesize
64KB

Download
memory/3644-3-0x0000000006240000-0x0000000006624000-memory.dmp

Filesize
3.9MB

Download
memory/3644-4-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-5-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-7-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-9-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-11-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-13-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-15-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-17-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-19-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-21-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-23-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-25-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-27-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-29-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-31-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-33-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-35-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-37-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-39-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-41-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-43-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-45-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-47-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-49-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-51-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-53-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-55-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-57-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-59-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-61-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-63-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-65-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-67-0x0000000006240000-0x000000000661F000-memory.dmp

Filesize
3.9MB

Download
memory/3644-1797-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/3644-2018-0x00000000059B0000-0x00000000059C0000-memory.dmp

Filesize
64KB

Download
memory/3644-4886-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/3644-4887-0x00000000078A0000-0x0000000007AC0000-memory.dmp

Filesize
2.1MB

Download
memory/3644-4888-0x0000000001910000-0x000000000195C000-memory.dmp

Filesize
304KB

Download
memory/3644-4889-0x0000000008070000-0x0000000008614000-memory.dmp

Filesize
5.6MB

Download
memory/3644-4890-0x00000000019A0000-0x00000000019F4000-memory.dmp

Filesize
336KB

Download
memory/3644-4898-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/3880-4897-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/3880-4900-0x0000000074760000-0x0000000074799000-memory.dmp

Filesize
228KB

Download
memory/3880-4908-0x0000000074420000-0x0000000074459000-memory.dmp

Filesize
228KB

Download
memory/3880-4909-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/3880-4912-0x0000000074420000-0x0000000074459000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads