Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 14:21
Static task
static1
Behavioral task
behavioral1
Sample
e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
Resource
win10v2004-20240319-en
General
-
Target
e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
-
Size
377KB
-
MD5
e52157c7d5b90e4cb0a526920f9c4bba
-
SHA1
7cb4d04789929ddbd2328b6ae155dd778a30b7c2
-
SHA256
c59f63a6ac9ac434dd9e414e9a088a3196c9a6a9756ff087034eae49fd08a676
-
SHA512
9eebf6523a9ee21699e926bf6daa8d474564fc2520425fd0b3e7a187b1ec2a223d51a45680a201368e5cee2133b883d0e2d4a4c544006c1ffbdc938ae30feb9d
-
SSDEEP
6144:/2n8tZ8hI966AGkAjOpoaY7nEd/o5Z4HwK7MnDXPvMUKARegsaHJHTc8gNmEk:/2dq6xGJOpqbEu8GTPvMUjxdc8gNm
Malware Config
Extracted
xtremerat
far3on.zapto.org
Signatures
-
Detect XtremeRAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3668-80-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/3668-81-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/3668-83-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/3184-86-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/3184-88-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exee52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXEdescription pid process target process PID 2980 set thread context of 3924 2980 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE PID 3924 set thread context of 3668 3924 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1960 3184 WerFault.exe svchost.exe 4812 3184 WerFault.exe svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exee52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXEpid process 2980 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe 3924 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exee52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXEe52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exedescription pid process target process PID 2980 wrote to memory of 3924 2980 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE PID 2980 wrote to memory of 3924 2980 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE PID 2980 wrote to memory of 3924 2980 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE PID 2980 wrote to memory of 3924 2980 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE PID 2980 wrote to memory of 3924 2980 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE PID 2980 wrote to memory of 3924 2980 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE PID 2980 wrote to memory of 3924 2980 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE PID 2980 wrote to memory of 3924 2980 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE PID 3924 wrote to memory of 3668 3924 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe PID 3924 wrote to memory of 3668 3924 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe PID 3924 wrote to memory of 3668 3924 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe PID 3924 wrote to memory of 3668 3924 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe PID 3924 wrote to memory of 3668 3924 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe PID 3924 wrote to memory of 3668 3924 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe PID 3924 wrote to memory of 3668 3924 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe PID 3924 wrote to memory of 3668 3924 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe PID 3924 wrote to memory of 3668 3924 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe PID 3924 wrote to memory of 3668 3924 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe PID 3924 wrote to memory of 3668 3924 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe PID 3924 wrote to memory of 3668 3924 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe PID 3924 wrote to memory of 3668 3924 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe PID 3668 wrote to memory of 3184 3668 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe svchost.exe PID 3668 wrote to memory of 3184 3668 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe svchost.exe PID 3668 wrote to memory of 3184 3668 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe svchost.exe PID 3668 wrote to memory of 3184 3668 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe svchost.exe PID 3668 wrote to memory of 2312 3668 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe msedge.exe PID 3668 wrote to memory of 2312 3668 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe msedge.exe PID 3668 wrote to memory of 2312 3668 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE"C:\Users\Admin\AppData\Local\Temp\e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵PID:3184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 4885⤵
- Program crash
PID:1960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 4965⤵
- Program crash
PID:4812 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:2312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3184 -ip 31841⤵PID:3356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3184 -ip 31841⤵PID:4624
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:81⤵PID:416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2980-38-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-43-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-2-0x0000000002360000-0x0000000002361000-memory.dmpFilesize
4KB
-
memory/2980-3-0x0000000002C00000-0x0000000002C01000-memory.dmpFilesize
4KB
-
memory/2980-4-0x0000000002BF0000-0x0000000002BF1000-memory.dmpFilesize
4KB
-
memory/2980-0-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/2980-7-0x0000000002380000-0x0000000002381000-memory.dmpFilesize
4KB
-
memory/2980-9-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-8-0x0000000002340000-0x0000000002341000-memory.dmpFilesize
4KB
-
memory/2980-10-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-11-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-13-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-14-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-15-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-16-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-17-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-18-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-19-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-20-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-21-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-22-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-23-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-24-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-25-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-26-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-27-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-28-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-29-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-30-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-31-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-32-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-33-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-34-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-35-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-36-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-37-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-6-0x0000000002C10000-0x0000000002C11000-memory.dmpFilesize
4KB
-
memory/2980-39-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-1-0x00000000022C0000-0x000000000231A000-memory.dmpFilesize
360KB
-
memory/2980-41-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-42-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-40-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-44-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-45-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-46-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-48-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-47-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-49-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-50-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-51-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-52-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-56-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-55-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-57-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-54-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-53-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-58-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-59-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-60-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-61-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-62-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-63-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-64-0x0000000003A00000-0x0000000003A26000-memory.dmpFilesize
152KB
-
memory/2980-65-0x0000000002320000-0x0000000002330000-memory.dmpFilesize
64KB
-
memory/2980-76-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/3184-86-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/3184-88-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/3668-80-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/3668-81-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/3668-83-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/3924-73-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3924-75-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3924-82-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB