bitrat | 746b35c07eefaba6dd40aa5a8b2389eb1ca04bed6ba23acd0a732a7148f3f258

Analysis

max time kernel
142s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
Size

4.9MB
MD5

f94a2299d0fe2837603734bbf0c3c161
SHA1

15f2d0ea4daf45e0418cd3e2dcfa55bdd1e6d819
SHA256

746b35c07eefaba6dd40aa5a8b2389eb1ca04bed6ba23acd0a732a7148f3f258
SHA512

0fa446b5d20618053d46ff96c538d40deee2da4811c63b876f479ea04442493b9d8675bafdc68a018d5abe4dca78ddaf8b9af46c2586fbe7fafe639613f3d5cd
SSDEEP

98304:fZS0r0bsJoWIUJMKXZy2rdh6RPYFBW6MLrPZsPKZVGOZNmOrTAn:hSHsSWHE0kPYFB0ZsPS8YNHT

Score

10^/10

bitrat evasion trojan

Malware Config

Extracted

Family

bitrat

Version

1.33

serviceop091.ddns.net:8035

Attributes

communication_password
c4ca4238a0b923820dcc509a6f75849b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource yara_rule

behavioral1/memory/2060-3-0x00000000002E0000-0x00000000002F8000-memory.dmp net_reactor

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/2060-3-0x00000000002E0000-0x00000000002F8000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

MSBuild.exe

pid process

2764 MSBuild.exe
2764 MSBuild.exe
2764 MSBuild.exe
2764 MSBuild.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description pid process target process

PID 2060 set thread context of 2764 2060 f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1800 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

pid process

2060 f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
2060 f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
2060 f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 2060 f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
Token: SeDebugPrivilege 2764 MSBuild.exe
Token: SeShutdownPrivilege 2764 MSBuild.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

MSBuild.exe

pid process

2764 MSBuild.exe
2764 MSBuild.exe

pid	process
2764	MSBuild.exe
2764	MSBuild.exe
2764	MSBuild.exe
2764	MSBuild.exe

description	pid	process	target process
PID 2060 set thread context of 2764	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe

pid	process
1800	schtasks.exe

pid	process
2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
Token: SeDebugPrivilege	2764	MSBuild.exe
Token: SeShutdownPrivilege	2764	MSBuild.exe

pid	process
2764	MSBuild.exe
2764	MSBuild.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description	pid	process	target process
PID 2060 wrote to memory of 1800	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	schtasks.exe
PID 2060 wrote to memory of 1800	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	schtasks.exe
PID 2060 wrote to memory of 1800	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	schtasks.exe
PID 2060 wrote to memory of 1800	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	schtasks.exe
PID 2060 wrote to memory of 2720	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 2060 wrote to memory of 2720	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 2060 wrote to memory of 2720	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 2060 wrote to memory of 2720	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 2060 wrote to memory of 2764	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 2060 wrote to memory of 2764	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 2060 wrote to memory of 2764	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 2060 wrote to memory of 2764	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 2060 wrote to memory of 2764	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 2060 wrote to memory of 2764	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 2060 wrote to memory of 2764	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 2060 wrote to memory of 2764	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 2060 wrote to memory of 2764	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 2060 wrote to memory of 2764	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 2060 wrote to memory of 2764	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 2060 wrote to memory of 2764	2060	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BGSTwJYFhUI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp33C.tmp"
2⤵
- Creates scheduled task(s)
PID:1800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:2720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2764

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp33C.tmp
Filesize
1KB

MD5
d705d513484d6a2d2aad722bc6ad93c9

SHA1
6253579355f6ad8d56fdafd69c59f8a3d45db7a0

SHA256
9eb7142e5ce382c6359ec75fce5d92217e97a01ad066d7179c3627f311557178

SHA512
ec752e10311276794fbbd46990925040b5cb8e4881c07e05993f637451104e18267d17abbaca7bd3996bab45699754dd1ae31f3c10c5c438614cdb4d5830a8cf

Download Submit
memory/2060-22-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2060-0-0x0000000000EB0000-0x00000000013A8000-memory.dmp

Filesize
5.0MB

Download
memory/2060-2-0x0000000007690000-0x00000000076D0000-memory.dmp

Filesize
256KB

Download
memory/2060-3-0x00000000002E0000-0x00000000002F8000-memory.dmp

Filesize
96KB

Download
memory/2060-4-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2060-5-0x0000000007690000-0x00000000076D0000-memory.dmp

Filesize
256KB

Download
memory/2060-6-0x00000000076D0000-0x0000000007AD0000-memory.dmp

Filesize
4.0MB

Download
memory/2060-1-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2764-25-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-29-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-15-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-16-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-17-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-18-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-19-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2764-20-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-13-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-23-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-24-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-12-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-26-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-27-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-28-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-14-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-30-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-31-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-32-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-33-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-34-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-35-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-36-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-37-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-38-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-39-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-40-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-41-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-42-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-43-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-44-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2764-45-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download