Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15-04-2024 10:54

General

  • Target

    f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe

  • Size

    211KB

  • MD5

    f0e35d7526ac18475f1cfcdd6c772a8c

  • SHA1

    525a6d099216ae252d803f0e47806a55621e6d9e

  • SHA256

    b9021561415bff1468c140ce32431baf1ee6f94aeacf450634f2b76232055438

  • SHA512

    923ccad09ede28890165792c9229076ba55683efb989da85dea14048abed45abd8ca40af77d4a086f5701daabbcc6da415e0c737bb98029dfcf411b2a0c3ab0a

  • SSDEEP

    6144:dqZ7oEYoRAQaUbRZH+CHRSwI7PTn422b4HuwIAXbPZcry+wNKevSK0b4EeU:da7TFUUbRMCf

Malware Config

Extracted

Family

xtremerat

C2

abcdgl.mooo.com

88.net

ƁᏘ캸glhacker.zapto.org

glhacwthackupdate.no-ip.biz

ƁᏘ캸winrarsfx.linkpc.net

winraabcdgl.mooo.com

.net

Signatures

  • Detect XtremeRAT payload 7 IoCs
  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Adds policy Run key to start application 2 TTPs 8 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\server.exe
      "C:\server.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • Modifies WinLogon for persistence
        • Adds policy Run key to start application
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        PID:2680
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:2588
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe
        3⤵
          PID:2900
      • C:\Wolfteam++.exe
        "C:\Wolfteam++.exe"
        2⤵
        • Executes dropped EXE
        PID:1700

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Boot or Logon Autostart Execution

    4
    T1547

    Registry Run Keys / Startup Folder

    3
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Privilege Escalation

    Boot or Logon Autostart Execution

    4
    T1547

    Registry Run Keys / Startup Folder

    3
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Defense Evasion

    Modify Registry

    4
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Wolfteam++.exe
      Filesize

      127KB

      MD5

      a33d838a724bdb6c4776c83cade05c8d

      SHA1

      1d461f8ce81fd9158206087257b4141e4210d589

      SHA256

      c87f6de3b8d6d0c21c3c3270322688199d1ca583f470f1ccf9a12c4326b745df

      SHA512

      d5e0628bef30ef699ce61501d7dd05eecc96a531dea471e8abd889bccfa1e71fb2e07e01cb70402546cdbe16c812a49a3c71f20846dfa6f5de1eb3b45b58c0a1

    • C:\server.exe
      Filesize

      44KB

      MD5

      a32d0301ec441c45da2e43061fa602b9

      SHA1

      cdb3fadd221c522141c927695f3d42eb5f579c16

      SHA256

      c7f4a0c976caa8f3b5a79bdd3235d0108a2670e6e6f2a412aa0d6fb7d3c6120a

      SHA512

      c18d9e6468e149f7c525ce64965324e62f2ce6df37138ce1a4401fde227bbbd61600c9947fce477759ad82e634bedd70bb7a6de4e6014338708bff06e88ff18d

    • memory/1700-33-0x0000000004980000-0x00000000049C0000-memory.dmp
      Filesize

      256KB

    • memory/1700-24-0x0000000073CC0000-0x00000000743AE000-memory.dmp
      Filesize

      6.9MB

    • memory/1700-23-0x00000000008B0000-0x00000000008D3000-memory.dmp
      Filesize

      140KB

    • memory/1700-42-0x0000000073CC0000-0x00000000743AE000-memory.dmp
      Filesize

      6.9MB

    • memory/1700-36-0x0000000004980000-0x00000000049C0000-memory.dmp
      Filesize

      256KB

    • memory/2148-3-0x0000000003CE0000-0x000000000479A000-memory.dmp
      Filesize

      10.7MB

    • memory/2588-35-0x0000000000C80000-0x0000000000C93000-memory.dmp
      Filesize

      76KB

    • memory/2588-40-0x0000000000C80000-0x0000000000C93000-memory.dmp
      Filesize

      76KB

    • memory/2588-41-0x0000000000C80000-0x0000000000C93000-memory.dmp
      Filesize

      76KB

    • memory/2680-27-0x0000000000C80000-0x0000000000C93000-memory.dmp
      Filesize

      76KB

    • memory/2680-25-0x0000000000C80000-0x0000000000C93000-memory.dmp
      Filesize

      76KB

    • memory/2888-37-0x0000000000C80000-0x0000000000C93000-memory.dmp
      Filesize

      76KB

    • memory/2900-31-0x0000000000C80000-0x0000000000C93000-memory.dmp
      Filesize

      76KB