bitrat | 00f90cda9f514832ed2e3d6c232ad0677b2bad1550719cf2a02f1988980942ff

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15-02-2024 08:00

Target

9d60e01d9595b6c66499c8bf32c2ea65.exe
Size

3.9MB
MD5

9d60e01d9595b6c66499c8bf32c2ea65
SHA1

619e2c8bf88d90c5982b22176597ec2525a88ce1
SHA256

00f90cda9f514832ed2e3d6c232ad0677b2bad1550719cf2a02f1988980942ff
SHA512

11fee982a4ded0f498b51a707e0622fc7d49de25e69bf7def6772e71997fcec18a3fc352b22eff260663f77abbda6dcc52daa406d1478d5ab02992245f7fda38
SSDEEP

98304:yU2vuU2djpabFxBaSpKHm/E/QJi3WpQnoE7/AWTM7/YlnuvzKf83e:KaOFxsPH/rWpQnoEDA0+Ylnb8

Score

10^/10

bitrat trojan

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1604	1384	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1604	1384	9d60e01d9595b6c66499c8bf32c2ea65.exe	28
PID 1384 wrote to memory of 1604	1384	9d60e01d9595b6c66499c8bf32c2ea65.exe	28
PID 1384 wrote to memory of 1604	1384	9d60e01d9595b6c66499c8bf32c2ea65.exe	28
PID 1384 wrote to memory of 1604	1384	9d60e01d9595b6c66499c8bf32c2ea65.exe	28

C:\Users\Admin\AppData\Local\Temp\9d60e01d9595b6c66499c8bf32c2ea65.exe
"C:\Users\Admin\AppData\Local\Temp\9d60e01d9595b6c66499c8bf32c2ea65.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 836
  2⤵
  - Program crash
  PID:1604

memory/1384-0-0x0000000000820000-0x0000000000C00000-memory.dmp

Filesize
3.9MB

Download
memory/1384-1-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/1384-2-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/1384-3-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1384-4-0x00000000069A0000-0x0000000006D77000-memory.dmp

Filesize
3.8MB

Download
memory/1384-5-0x0000000007910000-0x0000000007CE4000-memory.dmp

Filesize
3.8MB

Download
memory/1384-8-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/1384-7-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/1384-6-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/1384-9-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/1384-10-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/1384-11-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/1384-12-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/1384-13-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/1384-14-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download