Analysis
- max time kernel
149s - max time network
151s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/05/2021, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe
- Size 28KB
- Sample210505-3r982t87vx
- SHA256 a331107f9704db617f106c66b7fd9a49b7b3672dd4904b8c33aac540e55286a9
- MD5 bf4591c48593dd5b4e642c099a9e314b
- SHA1 272bfa22c1d1ebd2d1fe73ef37c9d09739616d38
- SHA512 5878f9a91d9b2411193c40ab8011b970ee3435f1bdc8f08e8931790893f280389695e85c6b9a0fc3e5e0d1103c8699f5131cab7cd9b088785d3b1538952412ff
- MD5 SHA1 SHA512
Malware Config
Signatures
- BitRAT Payload 3 IoCs
resource yara_rule behavioral2/memory/364-124-0x0000000000400000-0x00000000007CD000-memory.dmp family_bitrat behavioral2/memory/364-125-0x0000000000689A84-mapping.dmp family_bitrat behavioral2/memory/364-126-0x0000000000400000-0x00000000007CD000-memory.dmp family_bitrat - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 364 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 364 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 364 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 364 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 364 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4804 set thread context of 364 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 78 - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe Token: SeShutdownPrivilege 364 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 364 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 364 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4804 wrote to memory of 364 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 78 PID 4804 wrote to memory of 364 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 78 PID 4804 wrote to memory of 364 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 78 PID 4804 wrote to memory of 364 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 78 PID 4804 wrote to memory of 364 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 78 PID 4804 wrote to memory of 364 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 78 PID 4804 wrote to memory of 364 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 78 PID 4804 wrote to memory of 364 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 78 PID 4804 wrote to memory of 364 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 78 PID 4804 wrote to memory of 364 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 78 PID 4804 wrote to memory of 364 4804 a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe"C:\Users\Admin\AppData\Local\Temp\a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe"C:\Users\Admin\AppData\Local\Temp\a331107f9704db617f106c66b7fd9a49b7b3672dd4904.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:364
-