defection.io

malware

BitPaymer S0570

Type: malware
Platform: Windows
Created: 8 February 2021
Last modified: 11 April 2024

BitPaymer is a ransomware variant first observed in August 2017 targeting hospitals in the U.K. BitPaymer uses a unique encryption key, ransom note, and contact information for each operation. BitPaymer has several indicators suggesting overlap with the Dridex malware and is often delivered via Dridex.[1]

TechniquesTop 25%

Tactics68th pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

malware

BitPaymer S0570

Type: malware
Platform: Windows
Created: 8 February 2021
Last modified: 11 April 2024

TechniquesTop 25%

Tactics68th pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

BitPaymer MITRE reference S0570

System Service Discovery T1007 ↗

BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.2

Discovery13 detection rules

Query Registry T1012 ↗

BitPaymer can use the RegEnumKeyW to iterate through Registry keys.3

Discovery27 detection rules

Remote System Discovery T1018 ↗

BitPaymer can use net view to discover remote systems.4

Discovery39 detection rules

Encrypted/Encoded File T1027.013 ↗

BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.5

Stealth1 detection rules

Timestomp T1070.006 ↗

BitPaymer can modify the timestamp of an executable so that it can be identified and restored by the decryption tool.6

Stealth7 detection rules

Local Account T1087.001 ↗

BitPaymer can enumerate the sessions for each user logged onto the infected host.7

Discovery27 detection rules

Standing S0570

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques18Top 25%

75th percentile · 75% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.

Tactics768th pct

68th percentile · 68% of 825 ATT&CK software entries have this many tactics spanned or fewer.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique27med66th pct

66th percentile · 66% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique9medTop 19%

81st percentile · 81% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique4med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique1med57th pct

57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 18 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 394Splunk ESCU (cumulative) · 239

BitPaymer MITRE reference S0570

System Service Discovery T1007 ↗

BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.2

Discovery13 detection rules

Query Registry T1012 ↗

BitPaymer can use the RegEnumKeyW to iterate through Registry keys.3

Discovery27 detection rules

Remote System Discovery T1018 ↗

BitPaymer can use net view to discover remote systems.4

Discovery39 detection rules

Encrypted/Encoded File T1027.013 ↗

BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.5

Stealth1 detection rules

Timestomp T1070.006 ↗

BitPaymer can modify the timestamp of an executable so that it can be identified and restored by the decryption tool.6

Stealth7 detection rules

Local Account T1087.001 ↗

BitPaymer can enumerate the sessions for each user logged onto the infected host.7

Discovery27 detection rules

Standing S0570

Reach

Techniques18Top 25%

75th percentile · 75% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.

Tactics768th pct

68th percentile · 68% of 825 ATT&CK software entries have this many tactics spanned or fewer.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique27med66th pct

66th percentile · 66% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique9medTop 19%

81st percentile · 81% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique4med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique1med57th pct

57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 18 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 394Splunk ESCU (cumulative) · 239

BitPaymer detections S0570

633 distinct rules cover the 18 techniques recorded for this malware. 394 Sigma · 239 Splunk.

18 covered by at least one rule633 distinct rules in total

Showing 1-50 of 600+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.	Hunting	test	file_access	windows	-	Persistence, Defense Impairment Modify Registry	-	low	frack113	2023-09-15	2024-07-29	337a31c6-46c4-46be-886a-260d7aa78cac
	Detect set Notification_Suppress to 1 to disable the Windows security center notification	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	0c93308a-3f1b-40a9-b649-57ea1a1c1d63
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
	Detects WRITE_DAC access to a domain object	Generic	test	account_management	windows	WinEventLog Security	Defense Impairment File and Directory Permissions Modification Windows Permissions	-	critical	Roberto Rodriguez @Cyb3rWard0g	2019-09-12	2021-11-27	028c7842-4243-41cd-be6f-12f3cf1a26c7
	Detect set DisallowRun to 1 to prevent user running specific computer program	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	275641a5-a492-45e2-a817-7c81e9d9d3e9
Splunk	The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Network Service Discovery Discovery Network Share Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-10-24	2026-05-13	9a4e50c7-5b62-4d52-93b4-f2b61332e9a5
	Detects the deletion of all backups or system state backups via "wbadmin.exe". (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Impact Inhibit System Recovery	-	high	frack113, Nasreddine Bencherchali (Nextron Systems)	2021-12-13	2024-05-10	639c9081-f482-47d3-a0bd-ddee3d4ecd76
	Detect enable rdp feature to allow specific user to rdp connect on the targeted machine	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	37b437cf-3fc5-4c8e-9c94-1d7c9aff842b
	Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-02-28	2025-10-22	6c8fbee5-dee8-49bc-851d-c3142d02aa47
	Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	2022-10-20	1e53dd56-8d83-4eb4-a43e-b790a05510aa
	This rule will looks any process with low privilege launching Windows Installer service (msiexec.exe (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	—	078235c5-6ec5-48e7-94b2-f8b5474379ea
	Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	2024-12-01	cd951fdc-4b2f-47f5-ba99-a33bf61e3770
	Detects loading of Amsi.dll by uncommon processes	Hunting	test	image_load	windows	Sysmon	Impact Inhibit System Recovery	-	low	frack113	2023-03-12	2026-06-29	facd1549-e416-48e0-b8c4-41d7215eedc8
	Detects a highly relevant Antivirus alert that reports ransomware. (...)	Generic	test	antivirus	-	-	Impact Data Encrypted for Impact	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2022-05-12	2026-06-15	4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
	This method detects malicious services mentioned in APT29 report by FireEye. (...)	Unsupported	unsupported	process_creation	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Thomas Patzke	2017-11-01	2022-03-21	c069f460-2b87-4010-8dcf-e45bab362624
Splunk	The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Patrick Bareiss, Splunk	2020-10-27	2026-05-13	16ae9076-d1d5-411c-8fdd-457504b33dac
Splunk	The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Inhibit System Recovery	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	f32598bb-fa5f-4afd-8ab3-0263cc28efbc
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
Splunk	The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Rod Soto, Patrick Bareiss Splunk	2020-10-27	2026-05-13	c79c164f-4b21-4847-98f9-cf6a9f49179e
Splunk	The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Rod Soto, Patrick Bareiss Splunk	2020-10-27	2026-05-13	884a5f59-eec7-4f4a-948b-dbde18225fdc
Splunk	The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Inhibit System Recovery	-	medium	Bhavin Patel, Splunk	2023-05-01	2026-05-13	657902a9-987d-4879-a1b2-e7a65512824b
	Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact Impact Data Manipulation	-	medium	Sittikorn S	2021-06-29	2021-08-20	16124c2d-e40b-4fcc-8f2c-5ab7870a2223
	Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact Resource Development Stage Capabilities Install Digital Certificate	-	high	toopricey	2025-10-18	—	1279262f-1464-422f-ac0d-5b545320c526
	Detects when S3 bucket versioning is disabled. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Impact Inhibit System Recovery	-	medium	Sean Johnstone \| Unit 42	2023-10-28	—	a136ac98-b2bc-4189-a14d-f0d0388e57a7
	This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. (...)	Generic	test	-	windows	WinEventLog Security	Discovery Query Registry	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-08-26	2022-10-09	ff151c33-45fa-475d-af4f-c2f93571f4fe
	This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). (...)	Generic	test	-	windows	WinEventLog Security	Discovery Query Registry	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-08-26	2022-10-09	1d2ab8ac-1a01-423b-9c39-001510eae8e8
	Detects deletion of files with extensions often used for backup files. (...)	Generic	test	file_delete	windows	Sysmon	Impact Inhibit System Recovery	-	medium	frack113	2022-01-02	2023-02-15	06125661-3814-4e03-bfa2-1e4411c60ac3
Splunk	The following analytic detects the execution of a suspicious `bcdedit` command that reconfigures a host from safe mode back to normal boot. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Impact Inhibit System Recovery	-	medium	Teoderick Contreras, Splunk	2021-09-07	2026-05-13	dc7a8004-0f18-11ec-8c54-acde48001122
Splunk	The following analytic detects modifications to the Windows error recovery boot configurations using bcdedit.exe with flags such as "recoveryenabled" and "no". (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Impact Inhibit System Recovery	-	medium	Michael Haag, Splunk	2021-01-11	2026-10-02	809b31d2-5462-11eb-ae93-0242ac130002
	Detects specific windows registry modifications made by BlackByte ransomware variants. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-01-24	2025-10-21	83314318-052a-4c90-a1ad-660ece38d276
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2022-10-09	c3198a27-23a0-4c2c-af19-e5328d49680e
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2023-08-17	92b0b372-a939-44ed-a11b-5136cf680e27
	Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.	Emerging	test	file_event	windows	WinEventLog Security	Impact Data Encrypted for Impact	-	high	j4son	2023-05-23	—	eee8311f-a752-44f0-bf2f-6b007db16300
	Detects the use of the bcdedit command to tamper with the boot configuration data. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Impact Inhibit System Recovery	-	high	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2023-02-15	1444443e-6757-43e4-9ea4-c8fc705f79a2
	detects BPFDoor .lock and .pid files access in temporary file storage facility	Generic	test	file_event	linux	Linux Auditd	Execution Command and Scripting Interpreter Execution Native API	-	high	Rafal Piasecki	2022-08-10	2026-03-30	808146b2-9332-4d78-9416-d7e47012d83d
	Bypasses User Account Control using a fileless method	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	frack113	2022-01-05	2023-08-17	46dd5308-4572-4d12-aa43-8938f0184d4f
	Detects the setting of the environement variable "windir" to a non default value. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	frack113, Nextron Systems	2022-01-06	2024-01-30	724ea201-6514-4f38-9739-e5973c34f49a
	Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install sp (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Stealth System Binary Proxy Execution CMSTP	-	high	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2022-08-30	e66779cc-383e-4224-a3a4-267eeb585c40
	Identifies use of Fodhelper.exe to bypass User Account Control. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community	2019-10-24	2021-11-27	7f741dcf-fc22-4759-87b4-9ae8376676a2
	Detects use of WSReset.exe to bypass User Account Control (UAC). (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, Florian Roth	2019-10-24	2022-05-13	d797268e-28a9-49a7-b9a8-2f5039011c5c
	Detect possible persistence using Fax DLL load when service restart	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-07-17	2022-12-30	9e3357ba-09d4-4fbd-a7c5-ad6386314513
Splunk	The following analytic detects the execution of a suspicious `bcdedit` command that configures a host to boot in safe mode with network support. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Impact Inhibit System Recovery	-	medium	Teoderick Contreras, Splunk	2021-09-07	2026-05-13	81f1dce0-0f18-11ec-a5d7-acde48001122
	Detect change of the user account associated with the FAX service to avoid the escalation problem.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-07-17	2022-12-30	e3fdf743-f05b-4051-990a-b66919be1743
	Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	CVE-2022-41040 CVE-2022-41082	high	Florian Roth (Nextron Systems), MSTI (query)	2022-10-01	—	fa3c117a-bc0d-416e-a31b-0c0e80653efb
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Discovery Network Service Discovery Lateral Movement Remote Services SSH Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	efb20922-17bc-4fb0-880c-be50cfc100dd
	Modifications to a config that will serve an adversary's impacts or persistence	Generic	test	authentication	-	Cisco AAA · Cisco	Impact Data Manipulation Transmitted Data Manipulation Impact Inhibit System Recovery Execution, Persistence, Privilege Escalation Scheduled Task/Job Persistence Server Software Component	-	medium	Austin Clark	2019-08-12	2025-04-28	671ffc77-50a7-464f-9e3d-9ea2b493b26b	-
Splunk	The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	17e9b764-3a2b-4d36-9751-32d13ce4718b

...