bitrat | 5676b8e02ff5e2ed7ca6b07d32967250fc7d00bb5fb027ef624bf3676320f14f

Analysis

max time kernel
144s
max time network
139s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
02-04-2024 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f695447f315aae26536f653ea034987_JaffaCakes118.exe
Size

5.0MB
MD5

8f695447f315aae26536f653ea034987
SHA1

acc82b2769ce1eeb5b49678a9c71dc8d046af122
SHA256

5676b8e02ff5e2ed7ca6b07d32967250fc7d00bb5fb027ef624bf3676320f14f
SHA512

a114ac4877bfb7123d6d4957abca577c0143935543a385c8bce803532faa8393d05cd38d1bc99d6f317c4a08768ad9ecf1a759281cc9f8103c2c5f4fbeb6ba55
SSDEEP

98304:JOA2Ns9JXyYQlivimkQ+9vmwOMVoyd6+q/0M078XQgL:rusz2lCimkQYmwm+q/fQ

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

6.tcp.ngrok.io:10724

Attributes

communication_password
2ececd0e63e498b6f7514044265f451c
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	6.tcp.ngrok.io
7	6.tcp.ngrok.io
12	6.tcp.ngrok.io

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2096	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
2096	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
2096	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
2096	8f695447f315aae26536f653ea034987_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	28

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
Token: SeDebugPrivilege	2096	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
Token: SeShutdownPrivilege	2096	8f695447f315aae26536f653ea034987_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2096	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
2096	8f695447f315aae26536f653ea034987_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\8f695447f315aae26536f653ea034987_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8f695447f315aae26536f653ea034987_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\8f695447f315aae26536f653ea034987_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8f695447f315aae26536f653ea034987_JaffaCakes118.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-1-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/1720-0-0x0000000000DA0000-0x00000000011D6000-memory.dmp

Filesize
4.2MB

Download
memory/1720-2-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/1720-30-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/1720-29-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/2096-24-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-5-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-10-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-11-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-12-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2096-15-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-17-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-18-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-19-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-21-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-22-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-20-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-7-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-26-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-27-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-28-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-8-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-3-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-31-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-32-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-33-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-34-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-35-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-36-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-37-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-38-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-39-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-40-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-41-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-42-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-43-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-44-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-45-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download