bitrat | 3daa9cf8cbf7cfc41b3167b7906177338a992e00a4441b9ce6f9c2eb81b66ffa

General

Target

6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
Size

3.2MB
MD5

6c2597fdd22234c2e738ca0d8f05be66
SHA1

1d7b0760ff254f2858f14d6effd25de2b9d24d45
SHA256

3daa9cf8cbf7cfc41b3167b7906177338a992e00a4441b9ce6f9c2eb81b66ffa
SHA512

e5e8a99d071372b428674362e35e809e3baaea2de5a2d3fdda88f814de1200307f38a794214034889bec3183910e1ed08e393d74b5a910f20c30a20c7e093255
SSDEEP

24576:QkcetLrKpZRQ5zSLHMLj0G46jlV7cmjl94j9srIq7w0HqOT7IsMCfrXB4h8iaVAz:Q6xKH8siNjTSi7j1DXyh8ij0En

Score

10^/10

bitrat agilenet discovery persistence trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

favorali.duckdns.org:2331

Attributes

communication_password
81dc9bdb52d04dc20036dbd8313ed055
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

DTFYGU.exeAddInProcess32.exe

pid process

324 DTFYGU.exe
2764 AddInProcess32.exe

pid	process
324	DTFYGU.exe
2764	AddInProcess32.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/2168-8-0x00000000066E0000-0x0000000006708000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OPGOFIDUST = "C:\\Users\\Admin\\AppData\\Roaming\\DTFYGU.exe"	reg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

AddInProcess32.exe

pid process

2764 AddInProcess32.exe
2764 AddInProcess32.exe
2764 AddInProcess32.exe
2764 AddInProcess32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

DTFYGU.exe

description pid process target process

PID 324 set thread context of 2764 324 DTFYGU.exe AddInProcess32.exe

pid	process
2764	AddInProcess32.exe
2764	AddInProcess32.exe
2764	AddInProcess32.exe
2764	AddInProcess32.exe

description	pid	process	target process
PID 324 set thread context of 2764	324	DTFYGU.exe	AddInProcess32.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2764-37-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2764-36-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2764-40-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2764-38-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2764-34-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2764-44-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2764-50-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2764-52-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2764-53-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2764-54-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2764-56-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2764-57-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.execmd.exereg.exeDTFYGU.exeAddInProcess32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DTFYGU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exeDTFYGU.exe

pid	process
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
324	DTFYGU.exe
324	DTFYGU.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exeDTFYGU.exeAddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
Token: SeDebugPrivilege	324	DTFYGU.exe
Token: SeShutdownPrivilege	2764	AddInProcess32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AddInProcess32.exe

pid process

2764 AddInProcess32.exe
2764 AddInProcess32.exe

pid	process
2764	AddInProcess32.exe
2764	AddInProcess32.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.execmd.exeDTFYGU.exe

description	pid	process	target process
PID 2168 wrote to memory of 4240	2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe	cmd.exe
PID 2168 wrote to memory of 4240	2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe	cmd.exe
PID 2168 wrote to memory of 4240	2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe	cmd.exe
PID 4240 wrote to memory of 4172	4240	cmd.exe	reg.exe
PID 4240 wrote to memory of 4172	4240	cmd.exe	reg.exe
PID 4240 wrote to memory of 4172	4240	cmd.exe	reg.exe
PID 2168 wrote to memory of 324	2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe	DTFYGU.exe
PID 2168 wrote to memory of 324	2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe	DTFYGU.exe
PID 2168 wrote to memory of 324	2168	6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe	DTFYGU.exe
PID 324 wrote to memory of 2764	324	DTFYGU.exe	AddInProcess32.exe
PID 324 wrote to memory of 2764	324	DTFYGU.exe	AddInProcess32.exe
PID 324 wrote to memory of 2764	324	DTFYGU.exe	AddInProcess32.exe
PID 324 wrote to memory of 2764	324	DTFYGU.exe	AddInProcess32.exe
PID 324 wrote to memory of 2764	324	DTFYGU.exe	AddInProcess32.exe
PID 324 wrote to memory of 2764	324	DTFYGU.exe	AddInProcess32.exe
PID 324 wrote to memory of 2764	324	DTFYGU.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6c2597fdd22234c2e738ca0d8f05be66_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "OPGOFIDUST" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DTFYGU.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "OPGOFIDUST" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DTFYGU.exe"
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4172
- C:\Users\Admin\AppData\Roaming\DTFYGU.exe
  "C:\Users\Admin\AppData\Roaming\DTFYGU.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:324
- - C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
    "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

Filesize
42KB

MD5
9827ff3cdf4b83f9c86354606736ca9c

SHA1
e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723

SHA256
c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a

SHA512
8261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579

Download Submit
C:\Users\Admin\AppData\Roaming\DTFYGU.exe

Filesize
3.2MB

MD5
6c2597fdd22234c2e738ca0d8f05be66

SHA1
1d7b0760ff254f2858f14d6effd25de2b9d24d45

SHA256
3daa9cf8cbf7cfc41b3167b7906177338a992e00a4441b9ce6f9c2eb81b66ffa

SHA512
e5e8a99d071372b428674362e35e809e3baaea2de5a2d3fdda88f814de1200307f38a794214034889bec3183910e1ed08e393d74b5a910f20c30a20c7e093255

Download Submit
memory/324-41-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/324-26-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/324-31-0x0000000008250000-0x0000000008264000-memory.dmp

Filesize
80KB

Download
memory/324-32-0x0000000002D00000-0x0000000002D06000-memory.dmp

Filesize
24KB

Download
memory/324-30-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/324-29-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/324-28-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/2168-8-0x00000000066E0000-0x0000000006708000-memory.dmp

Filesize
160KB

Download
memory/2168-1-0x0000000000140000-0x0000000000476000-memory.dmp

Filesize
3.2MB

Download
memory/2168-11-0x000000007505E000-0x000000007505F000-memory.dmp

Filesize
4KB

Download
memory/2168-12-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/2168-2-0x00000000053A0000-0x0000000005944000-memory.dmp

Filesize
5.6MB

Download
memory/2168-9-0x0000000006740000-0x0000000006762000-memory.dmp

Filesize
136KB

Download
memory/2168-27-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/2168-10-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/2168-7-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/2168-6-0x0000000005950000-0x00000000059EC000-memory.dmp

Filesize
624KB

Download
memory/2168-4-0x0000000004DF0000-0x0000000005144000-memory.dmp

Filesize
3.3MB

Download
memory/2168-5-0x00000000051C0000-0x0000000005226000-memory.dmp

Filesize
408KB

Download
memory/2168-3-0x0000000004D10000-0x0000000004DA2000-memory.dmp

Filesize
584KB

Download
memory/2168-0-0x000000007505E000-0x000000007505F000-memory.dmp

Filesize
4KB

Download
memory/2764-57-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2764-38-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2764-36-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2764-34-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2764-40-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2764-43-0x0000000074F60000-0x0000000074F99000-memory.dmp

Filesize
228KB

Download
memory/2764-44-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2764-50-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2764-51-0x0000000075300000-0x0000000075339000-memory.dmp

Filesize
228KB

Download
memory/2764-52-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2764-53-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2764-54-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2764-55-0x0000000075300000-0x0000000075339000-memory.dmp

Filesize
228KB

Download
memory/2764-56-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2764-37-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2764-58-0x0000000075300000-0x0000000075339000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads