bitrat | fec73f9e948fb30fe01a715018c44268d64baead13d519e8e0065a844584f920

General

Target
f8b6181da93f514b6693f805dbfed63f.exe
Size 4.3MB
Sample210106-d5yy88setx
SHA256 fec73f9e948fb30fe01a715018c44268d64baead13d519e8e0065a844584f920
MD5 f8b6181da93f514b6693f805dbfed63f
SHA1 211010769c5c94ffac83a13838b0d49d6a624aaf
SHA512 988145aa7b202a96b6cb584e533a0ebf53c7715f3a7c10fc65424afc676c2255db5e813ab3326b38240593d9d3e4a308dc1e3b4f63919bb70ebed4b57b422e8b
MD5 SHA1 SHA512

Score

10^/10

bitrat trojan

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1564-4-0x0000000000400000-0x00000000007BF000-memory.dmp	family_bitrat
behavioral1/memory/1564-5-0x000000000067FE96-mapping.dmp	family_bitrat
behavioral1/memory/1564-6-0x0000000000400000-0x00000000007BF000-memory.dmp	family_bitrat

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1204 set thread context of 1564	1204	f8b6181da93f514b6693f805dbfed63f.exe	31

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1664	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	vbc.exe
Token: SeShutdownPrivilege	1564	vbc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1564	vbc.exe
1564	vbc.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1664	1204	f8b6181da93f514b6693f805dbfed63f.exe	29
PID 1204 wrote to memory of 1664	1204	f8b6181da93f514b6693f805dbfed63f.exe	29
PID 1204 wrote to memory of 1664	1204	f8b6181da93f514b6693f805dbfed63f.exe	29
PID 1204 wrote to memory of 1664	1204	f8b6181da93f514b6693f805dbfed63f.exe	29
PID 1204 wrote to memory of 1564	1204	f8b6181da93f514b6693f805dbfed63f.exe	31
PID 1204 wrote to memory of 1564	1204	f8b6181da93f514b6693f805dbfed63f.exe	31
PID 1204 wrote to memory of 1564	1204	f8b6181da93f514b6693f805dbfed63f.exe	31
PID 1204 wrote to memory of 1564	1204	f8b6181da93f514b6693f805dbfed63f.exe	31
PID 1204 wrote to memory of 1564	1204	f8b6181da93f514b6693f805dbfed63f.exe	31
PID 1204 wrote to memory of 1564	1204	f8b6181da93f514b6693f805dbfed63f.exe	31
PID 1204 wrote to memory of 1564	1204	f8b6181da93f514b6693f805dbfed63f.exe	31
PID 1204 wrote to memory of 1564	1204	f8b6181da93f514b6693f805dbfed63f.exe	31
PID 1204 wrote to memory of 1564	1204	f8b6181da93f514b6693f805dbfed63f.exe	31
PID 1204 wrote to memory of 1564	1204	f8b6181da93f514b6693f805dbfed63f.exe	31
PID 1204 wrote to memory of 1564	1204	f8b6181da93f514b6693f805dbfed63f.exe	31
PID 1204 wrote to memory of 1564	1204	f8b6181da93f514b6693f805dbfed63f.exe	31

C:\Users\Admin\AppData\Local\Temp\f8b6181da93f514b6693f805dbfed63f.exe
"C:\Users\Admin\AppData\Local\Temp\f8b6181da93f514b6693f805dbfed63f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uqEKxgRzmWu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1DEC.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1664
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1564