Analysis
- max time kernel
149s - max time network
152s - platform
windows10_x64 - resource
win10v20210410 - submitted
10/05/2021, 06:01
General
- Target r20210420L.exe
- Size 3.3MB
- Sample210510-2x6grm315e
- SHA256 6fa2dbb14d97035e18591f0de0e08f274f7ea45061be3816ddfbbefa8e04a695
Malware Config
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- BitRAT Payload 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\r20210420L.exe"C:\Users\Admin\AppData\Local\Temp\r20210420L.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BPjHaiWRlFtyhX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFADB.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\r20210420L.exe"C:\Users\Admin\AppData\Local\Temp\r20210420L.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\r20210420L.exe"C:\Users\Admin\AppData\Local\Temp\r20210420L.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/496-129-0x0000000000400000-0x00000000007CE000-memory.dmp
memory/496-127-0x0000000000400000-0x00000000007CE000-memory.dmp
memory/2112-121-0x0000000005020000-0x000000000551E000-memory.dmp
memory/2112-120-0x0000000005240000-0x0000000005241000-memory.dmp
memory/2112-114-0x00000000003B0000-0x00000000003B1000-memory.dmp
memory/2112-122-0x00000000053F0000-0x00000000053FE000-memory.dmp
memory/2112-123-0x00000000074F0000-0x0000000007800000-memory.dmp
memory/2112-124-0x0000000009AA0000-0x0000000009E72000-memory.dmp
memory/2112-119-0x0000000004F20000-0x0000000004F21000-memory.dmp
memory/2112-118-0x0000000005020000-0x0000000005021000-memory.dmp
memory/2112-117-0x0000000005520000-0x0000000005521000-memory.dmp
memory/2112-116-0x0000000004F80000-0x0000000004F81000-memory.dmp