Analysis
- max time kernel
143s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
16/04/2024, 14:19
General
- Target f3aaf224ffeaa26e00a6395a3b0a80b5_JaffaCakes118.exe
- Size 1.4MB
- Sample240416-rmw39acb36
- SHA256 f1041f8beb103e1f63fa8d5234ed3b5a55a37d1c675755040dbb08836c210a90
Malware Config
Extracted
-
bitrat
-
1.38
-
8.208.27.150:4550
-
communication_password
9996535e07258a7bbfd8b132435c5962
-
tor_process
tor
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3aaf224ffeaa26e00a6395a3b0a80b5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3aaf224ffeaa26e00a6395a3b0a80b5_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4792-0-0x0000000000400000-0x00000000007E4000-memory.dmp
memory/4792-1-0x0000000074840000-0x0000000074879000-memory.dmp
memory/4792-2-0x0000000074BE0000-0x0000000074C19000-memory.dmp
memory/4792-3-0x0000000000400000-0x00000000007E4000-memory.dmp
memory/4792-5-0x0000000074BE0000-0x0000000074C19000-memory.dmp
memory/4792-6-0x0000000000400000-0x00000000007E4000-memory.dmp
memory/4792-10-0x0000000074BE0000-0x0000000074C19000-memory.dmp
memory/4792-11-0x0000000000400000-0x00000000007E4000-memory.dmp
memory/4792-14-0x0000000074BE0000-0x0000000074C19000-memory.dmp
memory/4792-15-0x0000000000400000-0x00000000007E4000-memory.dmp
memory/4792-19-0x0000000074BE0000-0x0000000074C19000-memory.dmp
memory/4792-20-0x0000000000400000-0x00000000007E4000-memory.dmp