bitrat | 391a0926a39689253c6363a4138d05b6160e73032c97c4b9d6ed63ed8d1530ab | Triage

Analysis

max time kernel
148s
max time network
143s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 21:52 UTC

Sharing

Report Analysis Logs

General

Target

4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
Size

5.9MB
MD5

4b8fd05f24e7dd6a8c77decf26006818
SHA1

756afe0c25d5bed2e17ab459fa86f6d78ed01cc2
SHA256

391a0926a39689253c6363a4138d05b6160e73032c97c4b9d6ed63ed8d1530ab
SHA512

45c544268e98cdcaa576617e7e6d39132b2836564c43721478b0b79708057b98fa3c67c5c2c95f19eafd12e14c9cba1b4d50442120e27fb7a1f63e2029357c4f
SSDEEP

98304:eVjLh6fL15rloC3QUTb3oaurBOxaY6qZNeyRb+VXukHnq6HOTUkAtnvOkNj++:7DX3QUv7uYIY6qpRbQHH9APAJOqj++

Score

10^/10

bitrat persistence trojan vmprotect

Malware Config

Extracted

Family

bitrat

Version

1.32

C2

178.159.39.203:5552

Attributes

communication_password
e48e13207341b6bffb7fb1622282247b
install_dir
driversmgr
install_file
servicemgrdriver.exe
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

VMProtect packed file 7 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2844-9-0x0000000000400000-0x0000000000FD5000-memory.dmp	vmprotect
behavioral1/memory/2844-10-0x0000000000400000-0x0000000000FD5000-memory.dmp	vmprotect
behavioral1/memory/2844-11-0x0000000000400000-0x0000000000FD5000-memory.dmp	vmprotect
behavioral1/memory/2844-14-0x0000000000400000-0x0000000000FD5000-memory.dmp	vmprotect
behavioral1/memory/2844-18-0x0000000000400000-0x0000000000FD5000-memory.dmp	vmprotect
behavioral1/memory/2844-21-0x0000000000400000-0x0000000000FD5000-memory.dmp	vmprotect
behavioral1/memory/2844-25-0x0000000000400000-0x0000000000FD5000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\servicemgrdriver = "C:\\Users\\Admin\\AppData\\Local\\driversmgr\\servicemgrdriver.exe"	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

Suspicious behavior: RenamesItself 30 IoCs

pid	Process
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
Token: SeShutdownPrivilege	2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
2844	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2844

Network

No results found

178.159.39.203:5552

4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

152 B
3
178.159.39.203:5552

4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

152 B
3
178.159.39.203:5552

4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

152 B
3
178.159.39.203:5552

4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

152 B
3
178.159.39.203:5552

4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

152 B
3

No results found

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2844-6-0x0000000000717000-0x00000000009ED000-memory.dmp

Filesize
2.8MB

Download
memory/2844-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2844-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2844-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2844-9-0x0000000000400000-0x0000000000FD5000-memory.dmp

Filesize
11.8MB

Download
memory/2844-10-0x0000000000400000-0x0000000000FD5000-memory.dmp

Filesize
11.8MB

Download
memory/2844-11-0x0000000000400000-0x0000000000FD5000-memory.dmp

Filesize
11.8MB

Download
memory/2844-12-0x0000000000717000-0x00000000009ED000-memory.dmp

Filesize
2.8MB

Download
memory/2844-14-0x0000000000400000-0x0000000000FD5000-memory.dmp

Filesize
11.8MB

Download
memory/2844-18-0x0000000000400000-0x0000000000FD5000-memory.dmp

Filesize
11.8MB

Download
memory/2844-21-0x0000000000400000-0x0000000000FD5000-memory.dmp

Filesize
11.8MB

Download
memory/2844-25-0x0000000000400000-0x0000000000FD5000-memory.dmp

Filesize
11.8MB

Download