Analysis
-
max time kernel
143s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-10-2024 05:57
General
-
Target
60b16295c2f7b34128b7135af220c142_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
60b16295c2f7b34128b7135af220c142
-
SHA1
a2211b6e1d2708316c3086398df6d56a52494d5e
-
SHA256
e8cb7abe387fa940a5b97a00b50f30ddb613dbd31beae4005dee56232c7fb1b8
-
SHA512
3e0000a5ca8e5e797974145e50ab1213b0d8e4ecfaf38fa711f58c8836f13edd86b93aaf1e70a6f494cf87d676d2598f49f91adcbea66b2ec9816c14b270d996
-
SSDEEP
24576:LndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkziEmTxp+J:jXDFBU2iIBb0xY/6sUYYRLD
Malware Config
Extracted
bitrat
1.38
79.134.225.90:4898
-
communication_password
7fcc5163240be484c36ebae222f656b3
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\60b16295c2f7b34128b7135af220c142_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\60b16295c2f7b34128b7135af220c142_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB