bitrat | 746b35c07eefaba6dd40aa5a8b2389eb1ca04bed6ba23acd0a732a7148f3f258

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
Size

4.9MB
MD5

f94a2299d0fe2837603734bbf0c3c161
SHA1

15f2d0ea4daf45e0418cd3e2dcfa55bdd1e6d819
SHA256

746b35c07eefaba6dd40aa5a8b2389eb1ca04bed6ba23acd0a732a7148f3f258
SHA512

0fa446b5d20618053d46ff96c538d40deee2da4811c63b876f479ea04442493b9d8675bafdc68a018d5abe4dca78ddaf8b9af46c2586fbe7fafe639613f3d5cd
SSDEEP

98304:fZS0r0bsJoWIUJMKXZy2rdh6RPYFBW6MLrPZsPKZVGOZNmOrTAn:hSHsSWHE0kPYFB0ZsPS8YNHT

Score

10^/10

bitrat evasion trojan

Malware Config

Extracted

Family

bitrat

Version

1.33

serviceop091.ddns.net:8035

Attributes

communication_password
c4ca4238a0b923820dcc509a6f75849b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource yara_rule

behavioral2/memory/1972-8-0x0000000002950000-0x0000000002968000-memory.dmp net_reactor

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/1972-8-0x0000000002950000-0x0000000002968000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

MSBuild.exe

pid process

2768 MSBuild.exe
2768 MSBuild.exe
2768 MSBuild.exe
2768 MSBuild.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description pid process target process

PID 1972 set thread context of 2768 1972 f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4104 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

pid process

1972 f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 1972 f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
Token: SeShutdownPrivilege 2768 MSBuild.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

MSBuild.exe

pid process

2768 MSBuild.exe
2768 MSBuild.exe

pid	process
2768	MSBuild.exe
2768	MSBuild.exe
2768	MSBuild.exe
2768	MSBuild.exe

description	pid	process	target process
PID 1972 set thread context of 2768	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe

pid	process
4104	schtasks.exe

pid	process
1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
Token: SeShutdownPrivilege	2768	MSBuild.exe

pid	process
2768	MSBuild.exe
2768	MSBuild.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe

description	pid	process	target process
PID 1972 wrote to memory of 4104	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	schtasks.exe
PID 1972 wrote to memory of 4104	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	schtasks.exe
PID 1972 wrote to memory of 4104	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	schtasks.exe
PID 1972 wrote to memory of 2768	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 1972 wrote to memory of 2768	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 1972 wrote to memory of 2768	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 1972 wrote to memory of 2768	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 1972 wrote to memory of 2768	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 1972 wrote to memory of 2768	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 1972 wrote to memory of 2768	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 1972 wrote to memory of 2768	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 1972 wrote to memory of 2768	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 1972 wrote to memory of 2768	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe
PID 1972 wrote to memory of 2768	1972	f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BGSTwJYFhUI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5DCB.tmp"
2⤵
- Creates scheduled task(s)
PID:4104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2768

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5DCB.tmp
Filesize
1KB

MD5
eb8f9c7995210fb9cbc7db61ffddf03f

SHA1
e6427bd6addc51914a2eece3cfea4ca4e1393ee8

SHA256
110f5bd88fe555d829c0808583c443de3e11fce1115526edf7637c188e39d0ae

SHA512
46fd991c5ba34f58e4df7bf4b63fa8d0481f05a606b78295b39949a34d8855baa2ce067aee66cacde87eda9ce05855f4904a2072155e4c7ecd31f3488770cb82

Download Submit
memory/1972-6-0x0000000007460000-0x000000000746A000-memory.dmp

Filesize
40KB

Download
memory/1972-8-0x0000000002950000-0x0000000002968000-memory.dmp

Filesize
96KB

Download
memory/1972-3-0x0000000007AD0000-0x0000000008074000-memory.dmp

Filesize
5.6MB

Download
memory/1972-4-0x0000000007520000-0x00000000075B2000-memory.dmp

Filesize
584KB

Download
memory/1972-5-0x00000000076C0000-0x00000000076D0000-memory.dmp

Filesize
64KB

Download
memory/1972-23-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download
memory/1972-7-0x0000000007730000-0x0000000007786000-memory.dmp

Filesize
344KB

Download
memory/1972-2-0x0000000007480000-0x000000000751C000-memory.dmp

Filesize
624KB

Download
memory/1972-9-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download
memory/1972-10-0x00000000076C0000-0x00000000076D0000-memory.dmp

Filesize
64KB

Download
memory/1972-11-0x0000000006590000-0x0000000006990000-memory.dmp

Filesize
4.0MB

Download
memory/1972-12-0x0000000005390000-0x00000000053F6000-memory.dmp

Filesize
408KB

Download
memory/1972-1-0x00000000000F0000-0x00000000005E8000-memory.dmp

Filesize
5.0MB

Download
memory/1972-0-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download
memory/2768-29-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-37-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-21-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-19-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-24-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-25-0x00000000750E0000-0x0000000075119000-memory.dmp

Filesize
228KB

Download
memory/2768-26-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-27-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-28-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-18-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-30-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-31-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-32-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-33-0x00000000754E0000-0x0000000075519000-memory.dmp

Filesize
228KB

Download
memory/2768-34-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-35-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-36-0x00000000754E0000-0x0000000075519000-memory.dmp

Filesize
228KB

Download
memory/2768-20-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-38-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-39-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-49-0x00000000754E0000-0x0000000075519000-memory.dmp

Filesize
228KB

Download
memory/2768-50-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-51-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-52-0x00000000754E0000-0x0000000075519000-memory.dmp

Filesize
228KB

Download
memory/2768-53-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-54-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-55-0x00000000754E0000-0x0000000075519000-memory.dmp

Filesize
228KB

Download
memory/2768-56-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-57-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-58-0x00000000754E0000-0x0000000075519000-memory.dmp

Filesize
228KB

Download
memory/2768-59-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-60-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-61-0x00000000754E0000-0x0000000075519000-memory.dmp

Filesize
228KB

Download
memory/2768-62-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-63-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2768-64-0x00000000754E0000-0x0000000075519000-memory.dmp

Filesize
228KB

Download