bitrat | 5676b8e02ff5e2ed7ca6b07d32967250fc7d00bb5fb027ef624bf3676320f14f

General

Target

8f695447f315aae26536f653ea034987_JaffaCakes118.exe
Size

5.0MB
MD5

8f695447f315aae26536f653ea034987
SHA1

acc82b2769ce1eeb5b49678a9c71dc8d046af122
SHA256

5676b8e02ff5e2ed7ca6b07d32967250fc7d00bb5fb027ef624bf3676320f14f
SHA512

a114ac4877bfb7123d6d4957abca577c0143935543a385c8bce803532faa8393d05cd38d1bc99d6f317c4a08768ad9ecf1a759281cc9f8103c2c5f4fbeb6ba55
SSDEEP

98304:JOA2Ns9JXyYQlivimkQ+9vmwOMVoyd6+q/0M078XQgL:rusz2lCimkQYmwm+q/fQ

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

6.tcp.ngrok.io:10724

Attributes

communication_password
2ececd0e63e498b6f7514044265f451c
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

2 6.tcp.ngrok.io
7 6.tcp.ngrok.io
12 6.tcp.ngrok.io

flow	ioc
2	6.tcp.ngrok.io
7	6.tcp.ngrok.io
12	6.tcp.ngrok.io

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

8f695447f315aae26536f653ea034987_JaffaCakes118.exe

pid	process
2096	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
2096	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
2096	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
2096	8f695447f315aae26536f653ea034987_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8f695447f315aae26536f653ea034987_JaffaCakes118.exe

description	pid	process	target process
PID 1720 set thread context of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

8f695447f315aae26536f653ea034987_JaffaCakes118.exe8f695447f315aae26536f653ea034987_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
Token: SeDebugPrivilege	2096	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
Token: SeShutdownPrivilege	2096	8f695447f315aae26536f653ea034987_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

8f695447f315aae26536f653ea034987_JaffaCakes118.exe

pid process

2096 8f695447f315aae26536f653ea034987_JaffaCakes118.exe
2096 8f695447f315aae26536f653ea034987_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

8f695447f315aae26536f653ea034987_JaffaCakes118.exe

description	pid	process	target process
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 1720 wrote to memory of 2096	1720	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8f695447f315aae26536f653ea034987_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8f695447f315aae26536f653ea034987_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720

C:\Users\Admin\AppData\Local\Temp\8f695447f315aae26536f653ea034987_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8f695447f315aae26536f653ea034987_JaffaCakes118.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2096

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-1-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/1720-0-0x0000000000DA0000-0x00000000011D6000-memory.dmp

Filesize
4.2MB

Download
memory/1720-2-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/1720-30-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/1720-29-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/2096-24-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-5-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-10-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-11-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-12-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2096-15-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-17-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-18-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-19-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-21-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-22-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-20-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-7-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-26-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-27-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-28-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-8-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-3-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-31-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-32-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-33-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-34-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-35-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-36-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-37-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-38-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-39-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-40-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-41-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-42-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-43-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-44-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2096-45-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads