REPORTE DE PAGO DE NOMINA MES DE ABRIL.exe

General
Target

REPORTE DE PAGO DE NOMINA MES DE ABRIL.exe

Size

28KB

Sample

210408-zh7m7ge8ds

Score
10 /10
MD5

69e3b059a370bedcf025fa57dbb518ca

SHA1

6d310297f86670900bea73aded5ce28e9ab6912f

SHA256

df7b45ef48aac0f9a0a5f8596b06461a9a2e460ad9fd8c69035cf6d999b46d66

SHA512

ce6c1be3d7d210e4079e0386f76f5c42688848dd310c42b0cdf6cecf675fd6eee2d7f03ab2f3b78161fc2d1091215d65b6b3fbcb6d2143cef130eb569ac8295b

Malware Config
Targets
Target

REPORTE DE PAGO DE NOMINA MES DE ABRIL.exe

MD5

69e3b059a370bedcf025fa57dbb518ca

Filesize

28KB

Score
10 /10
SHA1

6d310297f86670900bea73aded5ce28e9ab6912f

SHA256

df7b45ef48aac0f9a0a5f8596b06461a9a2e460ad9fd8c69035cf6d999b46d66

SHA512

ce6c1be3d7d210e4079e0386f76f5c42688848dd310c42b0cdf6cecf675fd6eee2d7f03ab2f3b78161fc2d1091215d65b6b3fbcb6d2143cef130eb569ac8295b

Tags

Signatures

  • BitRAT

    Description

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    Tags

  • BitRAT Payload

  • Modifies Windows Defender Real-time Protection settings

    Tags

    TTPs

    Modify Registry Modify Existing Service Disabling Security Tools
  • Turns off Windows Defender SpyNet reporting

    Tags

    TTPs

    Disabling Security Tools Modify Registry
  • Windows security bypass

    Tags

    TTPs

    Disabling Security Tools Modify Registry
  • Nirsoft

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    Tags

    TTPs

    Disabling Security Tools Modify Registry
  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup Folder Modify Registry
  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Tasks

                    static1

                    behavioral1

                    10/10

                    behavioral2

                    10/10