bitrat | fec73f9e948fb30fe01a715018c44268d64baead13d519e8e0065a844584f920

General

Target
f8b6181da93f514b6693f805dbfed63f.exe
Size 4.3MB
Sample210106-d5yy88setx
SHA256 fec73f9e948fb30fe01a715018c44268d64baead13d519e8e0065a844584f920
MD5 f8b6181da93f514b6693f805dbfed63f
SHA1 211010769c5c94ffac83a13838b0d49d6a624aaf
SHA512 988145aa7b202a96b6cb584e533a0ebf53c7715f3a7c10fc65424afc676c2255db5e813ab3326b38240593d9d3e4a308dc1e3b4f63919bb70ebed4b57b422e8b
MD5 SHA1 SHA512

Score

10^/10

bitrat trojan

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT Payload 3 IoCs

resource	yara_rule
behavioral2/memory/1084-4-0x0000000000400000-0x00000000007BF000-memory.dmp	family_bitrat
behavioral2/memory/1084-5-0x000000000067FE96-mapping.dmp	family_bitrat
behavioral2/memory/1084-6-0x0000000000400000-0x00000000007BF000-memory.dmp	family_bitrat

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1192 set thread context of 1084	1192	f8b6181da93f514b6693f805dbfed63f.exe	81

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3672	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1084	vbc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1084	vbc.exe
1084	vbc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 3672	1192	f8b6181da93f514b6693f805dbfed63f.exe	79
PID 1192 wrote to memory of 3672	1192	f8b6181da93f514b6693f805dbfed63f.exe	79
PID 1192 wrote to memory of 3672	1192	f8b6181da93f514b6693f805dbfed63f.exe	79
PID 1192 wrote to memory of 1084	1192	f8b6181da93f514b6693f805dbfed63f.exe	81
PID 1192 wrote to memory of 1084	1192	f8b6181da93f514b6693f805dbfed63f.exe	81
PID 1192 wrote to memory of 1084	1192	f8b6181da93f514b6693f805dbfed63f.exe	81
PID 1192 wrote to memory of 1084	1192	f8b6181da93f514b6693f805dbfed63f.exe	81
PID 1192 wrote to memory of 1084	1192	f8b6181da93f514b6693f805dbfed63f.exe	81
PID 1192 wrote to memory of 1084	1192	f8b6181da93f514b6693f805dbfed63f.exe	81
PID 1192 wrote to memory of 1084	1192	f8b6181da93f514b6693f805dbfed63f.exe	81
PID 1192 wrote to memory of 1084	1192	f8b6181da93f514b6693f805dbfed63f.exe	81
PID 1192 wrote to memory of 1084	1192	f8b6181da93f514b6693f805dbfed63f.exe	81
PID 1192 wrote to memory of 1084	1192	f8b6181da93f514b6693f805dbfed63f.exe	81
PID 1192 wrote to memory of 1084	1192	f8b6181da93f514b6693f805dbfed63f.exe	81

C:\Users\Admin\AppData\Local\Temp\f8b6181da93f514b6693f805dbfed63f.exe
"C:\Users\Admin\AppData\Local\Temp\f8b6181da93f514b6693f805dbfed63f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uqEKxgRzmWu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp595C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3672
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1084