bitrat | 610919a36cadf1660895058ba6a5867ccb25ffe53bc1b19c06653c3ec5f218db

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe
Size

7.4MB
MD5

b6e04069e4e2f172ce5c14f2177243d9
SHA1

84ea3e27f1dbfd79f86e1e4b4d1835eaadbad20a
SHA256

610919a36cadf1660895058ba6a5867ccb25ffe53bc1b19c06653c3ec5f218db
SHA512

976cf6f79369a7fe236837d9bacd019390f6e894c81785f3b029f5f3a011d3a0647c19bf5e647b6615e9b54d6336f7fb390e2a74d0542f372fb20ceeaccdc5c2
SSDEEP

98304:eD4bx8VxKzW4Casjl7Fh3YJkDhIWHcTtvdJorssMf/:eoSODJsjhAJkDkxo6/

Score

10^/10

bitrat trojan

Malware Config

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT payload 26 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4504-13-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-12-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-16-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-14-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-15-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-20-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-21-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-23-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-25-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-24-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-26-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-28-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-27-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-29-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-31-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-32-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-40-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-39-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-42-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-65-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-67-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-66-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-69-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-70-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-71-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat
behavioral2/memory/4504-73-0x0000000000400000-0x00000000007FE000-memory.dmp	family_bitrat

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

27 myexternalip.com
28 myexternalip.com
52 myexternalip.com

flow	ioc
27	myexternalip.com
28	myexternalip.com
52	myexternalip.com

Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs

Processes:

svchost.exe

pid	process
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe

description pid process target process

PID 2132 set thread context of 4504 2132 b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe svchost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exesvchost.exe

description pid process

Token: SeDebugPrivilege 2132 b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe
Token: SeShutdownPrivilege 4504 svchost.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

svchost.exe

pid process

4504 svchost.exe
4504 svchost.exe

description	pid	process	target process
PID 2132 set thread context of 4504	2132	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe

description	pid	process
Token: SeDebugPrivilege	2132	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe
Token: SeShutdownPrivilege	4504	svchost.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe

description	pid	process	target process
PID 2132 wrote to memory of 4504	2132	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 2132 wrote to memory of 4504	2132	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 2132 wrote to memory of 4504	2132	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 2132 wrote to memory of 4504	2132	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 2132 wrote to memory of 4504	2132	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 2132 wrote to memory of 4504	2132	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 2132 wrote to memory of 4504	2132	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 2132 wrote to memory of 4504	2132	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 2132 wrote to memory of 4504	2132	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 2132 wrote to memory of 4504	2132	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe
PID 2132 wrote to memory of 4504	2132	b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b6e04069e4e2f172ce5c14f2177243d9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2132-18-0x0000000005420000-0x0000000005430000-memory.dmp

Filesize
64KB

Download
memory/2132-1-0x0000000000060000-0x00000000007CC000-memory.dmp

Filesize
7.4MB

Download
memory/2132-2-0x00000000050A0000-0x00000000053F4000-memory.dmp

Filesize
3.3MB

Download
memory/2132-3-0x00000000054D0000-0x000000000556C000-memory.dmp

Filesize
624KB

Download
memory/2132-5-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download
memory/2132-4-0x0000000005440000-0x000000000546E000-memory.dmp

Filesize
184KB

Download
memory/2132-6-0x0000000007A60000-0x0000000007A90000-memory.dmp

Filesize
192KB

Download
memory/2132-7-0x000000000A240000-0x000000000A7E4000-memory.dmp

Filesize
5.6MB

Download
memory/2132-8-0x0000000009DB0000-0x0000000009E42000-memory.dmp

Filesize
584KB

Download
memory/2132-9-0x00000000065F0000-0x0000000006608000-memory.dmp

Filesize
96KB

Download
memory/2132-10-0x0000000006600000-0x0000000006606000-memory.dmp

Filesize
24KB

Download
memory/2132-11-0x00000000067C0000-0x00000000067E2000-memory.dmp

Filesize
136KB

Download
memory/2132-0-0x000000007495E000-0x000000007495F000-memory.dmp

Filesize
4KB

Download
memory/2132-19-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download
memory/4504-21-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-30-0x0000000074BE0000-0x0000000074C19000-memory.dmp

Filesize
228KB

Download
memory/4504-15-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-16-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-12-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-20-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-13-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-22-0x0000000074840000-0x0000000074879000-memory.dmp

Filesize
228KB

Download
memory/4504-23-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-25-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-24-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-26-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-28-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-27-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-29-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-14-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-31-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-32-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-40-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-39-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-42-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-65-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-67-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-66-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-68-0x0000000073140000-0x0000000073179000-memory.dmp

Filesize
228KB

Download
memory/4504-69-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-70-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-71-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-73-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download