bitrat | e8cb7abe387fa940a5b97a00b50f30ddb613dbd31beae4005dee56232c7fb1b8

General

Target

60b16295c2f7b34128b7135af220c142_JaffaCakes118.exe
Size

1.4MB
MD5

60b16295c2f7b34128b7135af220c142
SHA1

a2211b6e1d2708316c3086398df6d56a52494d5e
SHA256

e8cb7abe387fa940a5b97a00b50f30ddb613dbd31beae4005dee56232c7fb1b8
SHA512

3e0000a5ca8e5e797974145e50ab1213b0d8e4ecfaf38fa711f58c8836f13edd86b93aaf1e70a6f494cf87d676d2598f49f91adcbea66b2ec9816c14b270d996
SSDEEP

24576:LndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkziEmTxp+J:jXDFBU2iIBb0xY/6sUYYRLD

Score

10^/10

bitrat discovery trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

79.134.225.90:4898

Attributes

communication_password
7fcc5163240be484c36ebae222f656b3
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5080	60b16295c2f7b34128b7135af220c142_JaffaCakes118.exe
5080	60b16295c2f7b34128b7135af220c142_JaffaCakes118.exe
5080	60b16295c2f7b34128b7135af220c142_JaffaCakes118.exe
5080	60b16295c2f7b34128b7135af220c142_JaffaCakes118.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5080-0-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/5080-3-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/5080-5-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/5080-8-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/5080-11-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/5080-12-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/5080-14-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/5080-17-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/5080-22-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/5080-26-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/5080-30-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60b16295c2f7b34128b7135af220c142_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5080	60b16295c2f7b34128b7135af220c142_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5080	60b16295c2f7b34128b7135af220c142_JaffaCakes118.exe
5080	60b16295c2f7b34128b7135af220c142_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\60b16295c2f7b34128b7135af220c142_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\60b16295c2f7b34128b7135af220c142_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5080-0-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5080-1-0x0000000074D50000-0x0000000074D89000-memory.dmp

Filesize
228KB

Download
memory/5080-2-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/5080-4-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/5080-3-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5080-5-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5080-7-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/5080-8-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5080-10-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/5080-11-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5080-13-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/5080-12-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5080-14-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5080-15-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/5080-16-0x0000000074D50000-0x0000000074D89000-memory.dmp

Filesize
228KB

Download
memory/5080-18-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/5080-17-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5080-19-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/5080-21-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/5080-22-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5080-23-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/5080-25-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/5080-27-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/5080-26-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5080-29-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download
memory/5080-30-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/5080-31-0x00000000750F0000-0x0000000075129000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing