bitrat | 5fc5899a46fe351361fc6245bfec6143e1f0daa8c2abf6a247af39e5a3c53353

Analysis

max time kernel
156s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 23:41

Target

SecuriteInfo.com.Other.Malware-gen.19697.1059.exe
Size

3.8MB
MD5

8609a72b7b7ba46f1fc639e609c0870b
SHA1

2b2692d603ee2d00a4845a6de336875094b2b810
SHA256

5fc5899a46fe351361fc6245bfec6143e1f0daa8c2abf6a247af39e5a3c53353
SHA512

9941a96754aafc4ef4671f2f591f2e156de1b622494e0c7e5c469989214b4c98998e5b7e03b75e513ddcb078c5d464b2d884c4db392e3096bd8fb604cc725166
SSDEEP

98304:P8iFdZx/7WCDQDoZRmP+2Kn3jyidc/qhDov:P8iFdfSzoUm2KnTa

Score

10^/10

bitrat trojan

Family

bitrat

Version

1.38

185.174.40.147:5200

Attributes

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

CasPol.exe

pid process

64 CasPol.exe
64 CasPol.exe
64 CasPol.exe
64 CasPol.exe
64 CasPol.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Other.Malware-gen.19697.1059.exe

description pid process target process

PID 1724 set thread context of 64 1724 SecuriteInfo.com.Other.Malware-gen.19697.1059.exe CasPol.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.Other.Malware-gen.19697.1059.exe

pid process

1724 SecuriteInfo.com.Other.Malware-gen.19697.1059.exe
1724 SecuriteInfo.com.Other.Malware-gen.19697.1059.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SecuriteInfo.com.Other.Malware-gen.19697.1059.exeCasPol.exe

description pid process

Token: SeDebugPrivilege 1724 SecuriteInfo.com.Other.Malware-gen.19697.1059.exe
Token: SeShutdownPrivilege 64 CasPol.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

CasPol.exe

pid process

64 CasPol.exe
64 CasPol.exe

description	pid	process	target process
PID 1724 set thread context of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	CasPol.exe

pid	process
1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe
1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe

description	pid	process
Token: SeDebugPrivilege	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe
Token: SeShutdownPrivilege	64	CasPol.exe

pid	process
64	CasPol.exe
64	CasPol.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

SecuriteInfo.com.Other.Malware-gen.19697.1059.exe

description	pid	process	target process
PID 1724 wrote to memory of 3604	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	CasPol.exe
PID 1724 wrote to memory of 3604	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	CasPol.exe
PID 1724 wrote to memory of 3604	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	CasPol.exe
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	CasPol.exe
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	CasPol.exe
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	CasPol.exe
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	CasPol.exe
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	CasPol.exe
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	CasPol.exe
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	CasPol.exe
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	CasPol.exe
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	CasPol.exe
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	CasPol.exe
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	CasPol.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
2⤵
PID:3604

memory/64-138-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/64-140-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/64-134-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/64-135-0x000000000068A488-mapping.dmp

Download
memory/64-145-0x0000000075050000-0x0000000075089000-memory.dmp

Filesize
228KB

Download
memory/64-136-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/64-144-0x0000000074C90000-0x0000000074CC9000-memory.dmp

Filesize
228KB

Download
memory/64-143-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/64-142-0x0000000075050000-0x0000000075089000-memory.dmp

Filesize
228KB

Download
memory/64-141-0x0000000074C90000-0x0000000074CC9000-memory.dmp

Filesize
228KB

Download
memory/1724-137-0x00007FF981CD0000-0x00007FF981EC5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-132-0x0000024212000000-0x00000242123DA000-memory.dmp

Filesize
3.9MB

Download
memory/1724-133-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/1724-139-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download