bitrat | bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49

General

Target

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
Size

30KB
MD5

ffe58002561c927433fb391a123c9f23
SHA1

7b8d97cef22c86e4c514b78d9ac529357c98d4d3
SHA256

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49
SHA512

8b7288ac5c2f10ebd1c4cfa9f92ae12aa2ebd6dd78b0693d00052b1725246b420fa79c2282c9768a66aef3cec699fd482fda9bdfaef9acac1f1dcdaae24c2a2e
SSDEEP

384:r3O6DXJnbUXZ5MPQWs5tYnhqsXHJfOroDsyGVOSmUpLlcw7Kk0fyfm4klrHByS:yisvLMpfOroDsZVA6Llcw7fAyfmxZ

Score

10^/10

bitrat zgrat persistence rat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

103.153.182.247:6161

Attributes

communication_password
81dc9bdb52d04dc20036dbd8313ed055
install_dir
Install path
install_file
Install name
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2364-3-0x00000000062B0000-0x0000000006694000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-4-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-5-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-7-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-9-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-11-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-13-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-15-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-17-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-19-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-21-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-23-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-25-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-27-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-29-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-31-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-33-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-35-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-37-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-39-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-41-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-43-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-45-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-47-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-49-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-51-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-53-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-55-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-57-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-59-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-61-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-63-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-65-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1
behavioral2/memory/2364-67-0x00000000062B0000-0x000000000668F000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Drops startup file 1 IoCs

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ujqqnhnbwgz.vbs	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Microsoft\Windows\CurrentVersion\Run\Install name = "C:\\Users\\Admin\\AppData\\Local\\Install path\\Install name"	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

pid	process
2976	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
2976	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
2976	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
2976	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

description	pid	process	target process
PID 2364 set thread context of 2976	2364	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

Suspicious behavior: RenamesItself 2 IoCs

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

pid	process
2976	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
2976	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exebfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

description	pid	process
Token: SeDebugPrivilege	2364	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
Token: SeDebugPrivilege	2364	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
Token: SeShutdownPrivilege	2976	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

pid	process
2976	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
2976	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

description	pid	process	target process
PID 2364 wrote to memory of 2976	2364	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 2364 wrote to memory of 2976	2364	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 2364 wrote to memory of 2976	2364	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 2364 wrote to memory of 2976	2364	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 2364 wrote to memory of 2976	2364	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 2364 wrote to memory of 2976	2364	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 2364 wrote to memory of 2976	2364	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 2364 wrote to memory of 2976	2364	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 2364 wrote to memory of 2976	2364	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 2364 wrote to memory of 2976	2364	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
PID 2364 wrote to memory of 2976	2364	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe	bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe

C:\Users\Admin\AppData\Local\Temp\bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
"C:\Users\Admin\AppData\Local\Temp\bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364

C:\Users\Admin\AppData\Local\Temp\bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe
"C:\Users\Admin\AppData\Local\Temp\bfba1372de8815592db5b58d15e36ecfad1428bd34aea1161b3552cedbc6ca49.exe"
2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2976

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2364-39-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-4888-0x00000000018C0000-0x000000000190C000-memory.dmp

Filesize
304KB

Download
memory/2364-2-0x0000000005A20000-0x0000000005A30000-memory.dmp

Filesize
64KB

Download
memory/2364-3-0x00000000062B0000-0x0000000006694000-memory.dmp

Filesize
3.9MB

Download
memory/2364-4-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-5-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-7-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-9-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-11-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-13-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-15-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-17-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-19-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-21-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-23-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-25-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-27-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-29-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-31-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-33-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-35-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-37-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-4898-0x0000000074910000-0x00000000750C1000-memory.dmp

Filesize
7.7MB

Download
memory/2364-1-0x0000000074910000-0x00000000750C1000-memory.dmp

Filesize
7.7MB

Download
memory/2364-49-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-45-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-47-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-43-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-51-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-53-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-55-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-57-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-59-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-61-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-63-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-65-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-67-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-1416-0x0000000074910000-0x00000000750C1000-memory.dmp

Filesize
7.7MB

Download
memory/2364-1591-0x0000000005A20000-0x0000000005A30000-memory.dmp

Filesize
64KB

Download
memory/2364-4886-0x0000000001390000-0x0000000001391000-memory.dmp

Filesize
4KB

Download
memory/2364-4887-0x0000000007A60000-0x0000000007C80000-memory.dmp

Filesize
2.1MB

Download
memory/2364-41-0x00000000062B0000-0x000000000668F000-memory.dmp

Filesize
3.9MB

Download
memory/2364-4889-0x0000000008230000-0x00000000087D6000-memory.dmp

Filesize
5.6MB

Download
memory/2364-4890-0x00000000019C0000-0x0000000001A14000-memory.dmp

Filesize
336KB

Download
memory/2364-0-0x0000000000E60000-0x0000000000E6E000-memory.dmp

Filesize
56KB

Download
memory/2976-4897-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2976-4900-0x0000000074680000-0x00000000746BC000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads