bitrat | 610919a36cadf1660895058ba6a5867ccb25ffe53bc1b19c06653c3ec5f218db

Analysis

max time kernel
147s
max time network
135s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe
Size

7.4MB
MD5

b6e04069e4e2f172ce5c14f2177243d9
SHA1

84ea3e27f1dbfd79f86e1e4b4d1835eaadbad20a
SHA256

610919a36cadf1660895058ba6a5867ccb25ffe53bc1b19c06653c3ec5f218db
SHA512

976cf6f79369a7fe236837d9bacd019390f6e894c81785f3b029f5f3a011d3a0647c19bf5e647b6615e9b54d6336f7fb390e2a74d0542f372fb20ceeaccdc5c2
SSDEEP

98304:eD4bx8VxKzW4Casjl7Fh3YJkDhIWHcTtvdJorssMf/:eoSODJsjhAJkDkxo6/

Score

10^/10

bitrat trojan

Malware Config

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT payload 30 IoCs

resource	yara_rule
behavioral1/memory/3028-14-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-16-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-15-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-12-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-19-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-21-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-22-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-23-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-24-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-25-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-26-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-28-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-27-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-29-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-30-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-31-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-32-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-33-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-36-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-37-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-56-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-55-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-58-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-83-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-84-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-85-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-86-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-89-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-90-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-91-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	myexternalip.com
10	myexternalip.com
23	myexternalip.com

Suspicious use of NtSetInformationThreadHideFromDebugger 23 IoCs

pid	Process
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3040 set thread context of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2772	3040	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe
Token: SeShutdownPrivilege	3028	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3028	svchost.exe
3028	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	28
PID 3040 wrote to memory of 2772	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	29
PID 3040 wrote to memory of 2772	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	29
PID 3040 wrote to memory of 2772	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	29
PID 3040 wrote to memory of 2772	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 1312
  2⤵
  - Program crash
  PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3028-30-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-31-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-32-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-15-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-12-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-100-0x0000000000880000-0x000000000088A000-memory.dmp

Filesize
40KB

Download
memory/3028-99-0x0000000000880000-0x000000000088A000-memory.dmp

Filesize
40KB

Download
memory/3028-9-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3028-11-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-19-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-21-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-22-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-23-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-24-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-25-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-26-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-28-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-27-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-29-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-14-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-85-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-16-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-33-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-7-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-91-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-90-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-89-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-87-0x0000000000880000-0x000000000088A000-memory.dmp

Filesize
40KB

Download
memory/3028-88-0x0000000000880000-0x000000000088A000-memory.dmp

Filesize
40KB

Download
memory/3028-86-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-36-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-37-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-39-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/3028-38-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/3028-56-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-55-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-58-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-65-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/3028-66-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/3028-83-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-84-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3040-2-0x0000000000230000-0x000000000025E000-memory.dmp

Filesize
184KB

Download
memory/3040-35-0x0000000074720000-0x0000000074E0E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-34-0x000000007472E000-0x000000007472F000-memory.dmp

Filesize
4KB

Download
memory/3040-6-0x0000000000580000-0x0000000000586000-memory.dmp

Filesize
24KB

Download
memory/3040-5-0x0000000000570000-0x0000000000588000-memory.dmp

Filesize
96KB

Download
memory/3040-4-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3040-3-0x0000000074720000-0x0000000074E0E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-1-0x0000000001010000-0x000000000177C000-memory.dmp

Filesize
7.4MB

Download
memory/3040-0-0x000000007472E000-0x000000007472F000-memory.dmp

Filesize
4KB

Download