bitrat | 610919a36cadf1660895058ba6a5867ccb25ffe53bc1b19c06653c3ec5f218db

Analysis

max time kernel
147s
max time network
135s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe
Size

7.4MB
MD5

b6e04069e4e2f172ce5c14f2177243d9
SHA1

84ea3e27f1dbfd79f86e1e4b4d1835eaadbad20a
SHA256

610919a36cadf1660895058ba6a5867ccb25ffe53bc1b19c06653c3ec5f218db
SHA512

976cf6f79369a7fe236837d9bacd019390f6e894c81785f3b029f5f3a011d3a0647c19bf5e647b6615e9b54d6336f7fb390e2a74d0542f372fb20ceeaccdc5c2
SSDEEP

98304:eD4bx8VxKzW4Casjl7Fh3YJkDhIWHcTtvdJorssMf/:eoSODJsjhAJkDkxo6/

Score

10^/10

bitrat trojan

Malware Config

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT payload 30 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3028-14-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-16-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-15-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-12-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-19-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-21-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-22-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-23-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-24-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-25-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-26-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-28-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-27-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-29-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-30-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-31-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-32-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-33-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-36-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-37-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-56-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-55-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-58-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-83-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-84-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-85-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-86-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-89-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-90-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral1/memory/3028-91-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 myexternalip.com
10 myexternalip.com
23 myexternalip.com

flow	ioc
9	myexternalip.com
10	myexternalip.com
23	myexternalip.com

Suspicious use of NtSetInformationThreadHideFromDebugger 23 IoCs

Processes:

svchost.exe

pid	process
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe
3028	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe

description pid process target process

PID 3040 set thread context of 3028 3040 b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe svchost.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2772 3040 WerFault.exe b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exesvchost.exe

description pid process

Token: SeDebugPrivilege 3040 b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe
Token: SeShutdownPrivilege 3028 svchost.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

svchost.exe

pid process

3028 svchost.exe
3028 svchost.exe

description	pid	process	target process
PID 3040 set thread context of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe

pid	pid_target	process	target process
2772	3040	WerFault.exe	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe
Token: SeShutdownPrivilege	3028	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe

description	pid	process	target process
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 3040 wrote to memory of 3028	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 3040 wrote to memory of 2772	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	WerFault.exe
PID 3040 wrote to memory of 2772	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	WerFault.exe
PID 3040 wrote to memory of 2772	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	WerFault.exe
PID 3040 wrote to memory of 2772	3040	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 1312
2⤵
- Program crash
PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3028-30-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-9-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-32-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-15-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-12-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-100-0x0000000000880000-0x000000000088A000-memory.dmp

Filesize
40KB

Download
memory/3028-99-0x0000000000880000-0x000000000088A000-memory.dmp

Filesize
40KB

Download
memory/3028-31-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3028-11-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-19-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-21-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-85-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-23-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-24-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-25-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-26-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-28-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-27-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-29-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-22-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-14-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-16-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-33-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-7-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-91-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-90-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-89-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-87-0x0000000000880000-0x000000000088A000-memory.dmp

Filesize
40KB

Download
memory/3028-88-0x0000000000880000-0x000000000088A000-memory.dmp

Filesize
40KB

Download
memory/3028-86-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-36-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-37-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-39-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/3028-38-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/3028-56-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-55-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-58-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-65-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/3028-66-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/3028-83-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3028-84-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3040-2-0x0000000000230000-0x000000000025E000-memory.dmp

Filesize
184KB

Download
memory/3040-35-0x0000000074720000-0x0000000074E0E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-34-0x000000007472E000-0x000000007472F000-memory.dmp

Filesize
4KB

Download
memory/3040-6-0x0000000000580000-0x0000000000586000-memory.dmp

Filesize
24KB

Download
memory/3040-5-0x0000000000570000-0x0000000000588000-memory.dmp

Filesize
96KB

Download
memory/3040-4-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3040-3-0x0000000074720000-0x0000000074E0E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-1-0x0000000001010000-0x000000000177C000-memory.dmp

Filesize
7.4MB

Download
memory/3040-0-0x000000007472E000-0x000000007472F000-memory.dmp

Filesize
4KB

Download