Overview

overview

10

Static

static

pob.exe

windows7_x64

pob.exe

windows10_x64

Analysis

  • max time kernel
    96s
  • max time network
    92s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    27-02-2021 10:22

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    pob.exe

  • Size

    66KB

  • MD5

    083e61fc5f310a663f5253286735d36e

  • SHA1

    a4f6ae6c3eaa32d21831af0d4001d44c0c2f7083

  • SHA256

    2a2ce0aca043486b9b1995b262cd4611b1376fc4b18440d7d4b3ee8cfff2c76a

  • SHA512

    32ea2de1f5e195efb1aad00b9812eda6ee962bd0e3146d813b630e614a6c8d4b363ee1eaba3b610d63852a1b4e6cf7036bc7ac99be959cf215d61389f8caf82f

Score
10/10
bitrattrojan

Malware Config

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • BitRAT Payload 3 IoCs
  • Beds Protector Packer 1 IoCs

    Detects Beds Protector packer used to load .NET malware.

  • Drops startup file 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pob.exe
    "C:\Users\Admin\AppData\Local\Temp\pob.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Local\Temp\pob.exe
      "C:\Users\Admin\AppData\Local\Temp\pob.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1500
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:904
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:1668
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x564
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1492
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:1660

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/660-17-0x000007FEF7D90000-0x000007FEF800A000-memory.dmp
        Filesize

        2.5MB

        Download
      • memory/904-7-0x000007FEFC601000-0x000007FEFC603000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1500-11-0x00000000761E1000-0x00000000761E3000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1500-12-0x0000000000400000-0x00000000007CD000-memory.dmp
        Filesize

        3.8MB

        Download
      • memory/1500-15-0x0000000000260000-0x0000000000261000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1500-14-0x0000000000260000-0x0000000000261000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1500-9-0x0000000000400000-0x00000000007CD000-memory.dmp
        Filesize

        3.8MB

        Download
      • memory/1500-10-0x0000000000689A84-mapping.dmp
        Download
      • memory/1500-13-0x0000000000260000-0x0000000000261000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1660-21-0x0000000002920000-0x0000000002921000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1668-19-0x00000000028C0000-0x00000000028C1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1724-6-0x0000000006210000-0x0000000006403000-memory.dmp
        Filesize

        1.9MB

        Download
      • memory/1724-2-0x0000000074D20000-0x000000007540E000-memory.dmp
        Filesize

        6.9MB

        Download
      • memory/1724-8-0x0000000000320000-0x0000000000321000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1724-5-0x0000000004910000-0x0000000004911000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1724-3-0x0000000001000000-0x0000000001001000-memory.dmp
        Filesize

        4KB

        Download