bitrat | 5676b8e02ff5e2ed7ca6b07d32967250fc7d00bb5fb027ef624bf3676320f14f

Analysis

max time kernel
148s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f695447f315aae26536f653ea034987_JaffaCakes118.exe
Size

5.0MB
MD5

8f695447f315aae26536f653ea034987
SHA1

acc82b2769ce1eeb5b49678a9c71dc8d046af122
SHA256

5676b8e02ff5e2ed7ca6b07d32967250fc7d00bb5fb027ef624bf3676320f14f
SHA512

a114ac4877bfb7123d6d4957abca577c0143935543a385c8bce803532faa8393d05cd38d1bc99d6f317c4a08768ad9ecf1a759281cc9f8103c2c5f4fbeb6ba55
SSDEEP

98304:JOA2Ns9JXyYQlivimkQ+9vmwOMVoyd6+q/0M078XQgL:rusz2lCimkQYmwm+q/fQ

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

6.tcp.ngrok.io:10724

Attributes

communication_password
2ececd0e63e498b6f7514044265f451c
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

8f695447f315aae26536f653ea034987_JaffaCakes118.exe

description	pid	process	target process
PID 4060 set thread context of 4884	4060	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1800 4884 WerFault.exe 8f695447f315aae26536f653ea034987_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8f695447f315aae26536f653ea034987_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4060 8f695447f315aae26536f653ea034987_JaffaCakes118.exe

pid	pid_target	process	target process
1800	4884	WerFault.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4060	8f695447f315aae26536f653ea034987_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

8f695447f315aae26536f653ea034987_JaffaCakes118.exe

description	pid	process	target process
PID 4060 wrote to memory of 4884	4060	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 4060 wrote to memory of 4884	4060	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 4060 wrote to memory of 4884	4060	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 4060 wrote to memory of 4884	4060	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 4060 wrote to memory of 4884	4060	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 4060 wrote to memory of 4884	4060	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 4060 wrote to memory of 4884	4060	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 4060 wrote to memory of 4884	4060	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 4060 wrote to memory of 4884	4060	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 4060 wrote to memory of 4884	4060	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe
PID 4060 wrote to memory of 4884	4060	8f695447f315aae26536f653ea034987_JaffaCakes118.exe	8f695447f315aae26536f653ea034987_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8f695447f315aae26536f653ea034987_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8f695447f315aae26536f653ea034987_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060

C:\Users\Admin\AppData\Local\Temp\8f695447f315aae26536f653ea034987_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8f695447f315aae26536f653ea034987_JaffaCakes118.exe"
2⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 188
3⤵
- Program crash
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4884 -ip 4884
1⤵
PID:544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4060-0-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/4060-1-0x00000000001F0000-0x0000000000626000-memory.dmp

Filesize
4.2MB

Download
memory/4060-2-0x0000000005660000-0x0000000005C04000-memory.dmp

Filesize
5.6MB

Download
memory/4060-3-0x0000000005150000-0x00000000051E2000-memory.dmp

Filesize
584KB

Download
memory/4060-4-0x0000000002A60000-0x0000000002A70000-memory.dmp

Filesize
64KB

Download
memory/4060-5-0x00000000050F0000-0x00000000050FA000-memory.dmp

Filesize
40KB

Download
memory/4060-16-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/4060-17-0x0000000002A60000-0x0000000002A70000-memory.dmp

Filesize
64KB

Download
memory/4884-7-0x0000000001380000-0x000000000174E000-memory.dmp

Filesize
3.8MB

Download
memory/4884-11-0x0000000001380000-0x000000000174E000-memory.dmp

Filesize
3.8MB

Download
memory/4884-15-0x0000000001380000-0x000000000174E000-memory.dmp

Filesize
3.8MB

Download