Analysis
- max time kernel
149s - max time network
149s - platform
windows7_x64 - resource
win7v20210410 - submitted
05/05/2021, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe
- Size 28KB
- Sample210505-3r982t87vx
- SHA256 a331107f9704db617f106c66b7fd9a49b7b3672dd4904b8c33aac540e55286a9
- MD5 bf4591c48593dd5b4e642c099a9e314b
- SHA1 272bfa22c1d1ebd2d1fe73ef37c9d09739616d38
- SHA512 5878f9a91d9b2411193c40ab8011b970ee3435f1bdc8f08e8931790893f280389695e85c6b9a0fc3e5e0d1103c8699f5131cab7cd9b088785d3b1538952412ff
- MD5 SHA1 SHA512
Malware Config
Signatures
- BitRAT Payload 3 IoCs
resource yara_rule behavioral1/memory/772-66-0x0000000000689A84-mapping.dmp family_bitrat behavioral1/memory/772-65-0x0000000000400000-0x00000000007CD000-memory.dmp family_bitrat behavioral1/memory/772-68-0x0000000000400000-0x00000000007CD000-memory.dmp family_bitrat - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 772 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 772 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 772 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 772 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 772 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2000 set thread context of 772 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 29 - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe Token: SeDebugPrivilege 772 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe Token: SeShutdownPrivilege 772 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 772 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 772 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2000 wrote to memory of 772 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 29 PID 2000 wrote to memory of 772 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 29 PID 2000 wrote to memory of 772 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 29 PID 2000 wrote to memory of 772 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 29 PID 2000 wrote to memory of 772 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 29 PID 2000 wrote to memory of 772 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 29 PID 2000 wrote to memory of 772 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 29 PID 2000 wrote to memory of 772 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 29 PID 2000 wrote to memory of 772 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 29 PID 2000 wrote to memory of 772 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 29 PID 2000 wrote to memory of 772 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 29 PID 2000 wrote to memory of 772 2000 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe"C:\Users\Admin\AppData\Local\Temp\a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe"C:\Users\Admin\AppData\Local\Temp\a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:772
-