bitrat | 5fc5899a46fe351361fc6245bfec6143e1f0daa8c2abf6a247af39e5a3c53353

Analysis

max time kernel
156s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 23:41

Target

SecuriteInfo.com.Other.Malware-gen.19697.1059.exe
Size

3.8MB
MD5

8609a72b7b7ba46f1fc639e609c0870b
SHA1

2b2692d603ee2d00a4845a6de336875094b2b810
SHA256

5fc5899a46fe351361fc6245bfec6143e1f0daa8c2abf6a247af39e5a3c53353
SHA512

9941a96754aafc4ef4671f2f591f2e156de1b622494e0c7e5c469989214b4c98998e5b7e03b75e513ddcb078c5d464b2d884c4db392e3096bd8fb604cc725166
SSDEEP

98304:P8iFdZx/7WCDQDoZRmP+2Kn3jyidc/qhDov:P8iFdfSzoUm2KnTa

Score

10^/10

bitrat trojan

Family

bitrat

Version

1.38

185.174.40.147:5200

Attributes

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe
1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe
Token: SeShutdownPrivilege	64	CasPol.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
64	CasPol.exe
64	CasPol.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 3604	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	82
PID 1724 wrote to memory of 3604	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	82
PID 1724 wrote to memory of 3604	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	82
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	83
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	83
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	83
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	83
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	83
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	83
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	83
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	83
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	83
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	83
PID 1724 wrote to memory of 64	1724	SecuriteInfo.com.Other.Malware-gen.19697.1059.exe	83

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Other.Malware-gen.19697.1059.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Other.Malware-gen.19697.1059.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:3604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:64

memory/64-138-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/64-142-0x0000000075050000-0x0000000075089000-memory.dmp

Filesize
228KB

Download
memory/64-134-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/64-145-0x0000000075050000-0x0000000075089000-memory.dmp

Filesize
228KB

Download
memory/64-136-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/64-140-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/64-144-0x0000000074C90000-0x0000000074CC9000-memory.dmp

Filesize
228KB

Download
memory/64-143-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/64-141-0x0000000074C90000-0x0000000074CC9000-memory.dmp

Filesize
228KB

Download
memory/1724-132-0x0000024212000000-0x00000242123DA000-memory.dmp

Filesize
3.9MB

Download
memory/1724-133-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/1724-139-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/1724-137-0x00007FF981CD0000-0x00007FF981EC5000-memory.dmp

Filesize
2.0MB

Download