bitrat | 391a0926a39689253c6363a4138d05b6160e73032c97c4b9d6ed63ed8d1530ab

General

Target

4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
Size

5.9MB
MD5

4b8fd05f24e7dd6a8c77decf26006818
SHA1

756afe0c25d5bed2e17ab459fa86f6d78ed01cc2
SHA256

391a0926a39689253c6363a4138d05b6160e73032c97c4b9d6ed63ed8d1530ab
SHA512

45c544268e98cdcaa576617e7e6d39132b2836564c43721478b0b79708057b98fa3c67c5c2c95f19eafd12e14c9cba1b4d50442120e27fb7a1f63e2029357c4f
SSDEEP

98304:eVjLh6fL15rloC3QUTb3oaurBOxaY6qZNeyRb+VXukHnq6HOTUkAtnvOkNj++:7DX3QUv7uYIY6qpRbQHH9APAJOqj++

Score

10^/10

bitrat persistence trojan vmprotect

Malware Config

Extracted

Family

bitrat

Version

1.32

C2

178.159.39.203:5552

Attributes

communication_password
e48e13207341b6bffb7fb1622282247b
install_dir
driversmgr
install_file
servicemgrdriver.exe
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

VMProtect packed file 7 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/3996-1-0x0000000000400000-0x0000000000FD5000-memory.dmp	vmprotect
behavioral2/memory/3996-5-0x0000000000400000-0x0000000000FD5000-memory.dmp	vmprotect
behavioral2/memory/3996-7-0x0000000000400000-0x0000000000FD5000-memory.dmp	vmprotect
behavioral2/memory/3996-11-0x0000000000400000-0x0000000000FD5000-memory.dmp	vmprotect
behavioral2/memory/3996-16-0x0000000000400000-0x0000000000FD5000-memory.dmp	vmprotect
behavioral2/memory/3996-20-0x0000000000400000-0x0000000000FD5000-memory.dmp	vmprotect
behavioral2/memory/3996-25-0x0000000000400000-0x0000000000FD5000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\servicemgrdriver = "C:\\Users\\Admin\\AppData\\Local\\driversmgr\\servicemgrdriver.exeȀ"	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\servicemgrdriver = "C:\\Users\\Admin\\AppData\\Local\\driversmgr\\servicemgrdriver.exe琀"	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\servicemgrdriver = "C:\\Users\\Admin\\AppData\\Local\\driversmgr\\servicemgrdriver.exe"	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

Suspicious behavior: RenamesItself 30 IoCs

pid	Process
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
3996	4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3996-1-0x0000000000400000-0x0000000000FD5000-memory.dmp

Filesize
11.8MB

Download
memory/3996-2-0x0000000000717000-0x00000000009ED000-memory.dmp

Filesize
2.8MB

Download
memory/3996-0-0x0000000001160000-0x0000000001161000-memory.dmp

Filesize
4KB

Download
memory/3996-5-0x0000000000400000-0x0000000000FD5000-memory.dmp

Filesize
11.8MB

Download
memory/3996-6-0x0000000075000000-0x0000000075039000-memory.dmp

Filesize
228KB

Download
memory/3996-7-0x0000000000400000-0x0000000000FD5000-memory.dmp

Filesize
11.8MB

Download
memory/3996-8-0x0000000000717000-0x00000000009ED000-memory.dmp

Filesize
2.8MB

Download
memory/3996-10-0x0000000074CC0000-0x0000000074CF9000-memory.dmp

Filesize
228KB

Download
memory/3996-11-0x0000000000400000-0x0000000000FD5000-memory.dmp

Filesize
11.8MB

Download
memory/3996-15-0x0000000074CC0000-0x0000000074CF9000-memory.dmp

Filesize
228KB

Download
memory/3996-16-0x0000000000400000-0x0000000000FD5000-memory.dmp

Filesize
11.8MB

Download
memory/3996-19-0x0000000074CC0000-0x0000000074CF9000-memory.dmp

Filesize
228KB

Download
memory/3996-20-0x0000000000400000-0x0000000000FD5000-memory.dmp

Filesize
11.8MB

Download
memory/3996-24-0x0000000074CC0000-0x0000000074CF9000-memory.dmp

Filesize
228KB

Download
memory/3996-25-0x0000000000400000-0x0000000000FD5000-memory.dmp

Filesize
11.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads