Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 10:54
Behavioral task
behavioral1
Sample
f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe
-
Size
211KB
-
MD5
f0e35d7526ac18475f1cfcdd6c772a8c
-
SHA1
525a6d099216ae252d803f0e47806a55621e6d9e
-
SHA256
b9021561415bff1468c140ce32431baf1ee6f94aeacf450634f2b76232055438
-
SHA512
923ccad09ede28890165792c9229076ba55683efb989da85dea14048abed45abd8ca40af77d4a086f5701daabbcc6da415e0c737bb98029dfcf411b2a0c3ab0a
-
SSDEEP
6144:dqZ7oEYoRAQaUbRZH+CHRSwI7PTn422b4HuwIAXbPZcry+wNKevSK0b4EeU:da7TFUUbRMCf
Malware Config
Extracted
xtremerat
abcdgl.mooo.com
88.net
ƁᏘ캸glhacker.zapto.org
glhacwthackupdate.no-ip.biz
ƁᏘ캸winrarsfx.linkpc.net
winraabcdgl.mooo.com
.net
Signatures
-
Detect XtremeRAT payload 7 IoCs
Processes:
resource yara_rule C:\server.exe family_xtremerat behavioral2/memory/4108-27-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2148-30-0x00000000051D0000-0x00000000051E0000-memory.dmp family_xtremerat behavioral2/memory/380-32-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/1088-34-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/380-36-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/380-37-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat -
Modifies WinLogon for persistence 2 TTPs 4 IoCs
Processes:
server.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\Microsoft\\update.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\Microsoft\\update.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\Microsoft\\update.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\Microsoft\\update.exe" svchost.exe -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Adds policy Run key to start application 2 TTPs 8 IoCs
Processes:
svchost.exeserver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" server.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" server.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
server.exesvchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4EL34C4-EOX8-G74W-4066-AU2QRKI1J2A3} server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4EL34C4-EOX8-G74W-4066-AU2QRKI1J2A3}\StubPath = "C:\\Windows\\Microsoft\\update.exe restart" server.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4EL34C4-EOX8-G74W-4066-AU2QRKI1J2A3} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4EL34C4-EOX8-G74W-4066-AU2QRKI1J2A3}\StubPath = "C:\\Windows\\Microsoft\\update.exe restart" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
server.exeWolfteam++.exepid process 1088 server.exe 2148 Wolfteam++.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
server.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\winupdate = "C:\\Windows\\Microsoft\\update.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\winupdate = "C:\\Windows\\Microsoft\\update.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\winupdate = "C:\\Windows\\Microsoft\\update.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\winupdate = "C:\\Windows\\Microsoft\\update.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" server.exe -
Drops file in Windows directory 3 IoCs
Processes:
server.exedescription ioc process File opened for modification C:\Windows\Microsoft\update.exe server.exe File created C:\Windows\Microsoft\update.exe server.exe File opened for modification C:\Windows\Microsoft\ server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exesvchost.exepid process 4824 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe 380 svchost.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exeserver.exedescription pid process target process PID 4824 wrote to memory of 1088 4824 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe server.exe PID 4824 wrote to memory of 1088 4824 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe server.exe PID 4824 wrote to memory of 1088 4824 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe server.exe PID 4824 wrote to memory of 2148 4824 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe Wolfteam++.exe PID 4824 wrote to memory of 2148 4824 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe Wolfteam++.exe PID 4824 wrote to memory of 2148 4824 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe Wolfteam++.exe PID 1088 wrote to memory of 4108 1088 server.exe svchost.exe PID 1088 wrote to memory of 4108 1088 server.exe svchost.exe PID 1088 wrote to memory of 4108 1088 server.exe svchost.exe PID 1088 wrote to memory of 4108 1088 server.exe svchost.exe PID 1088 wrote to memory of 380 1088 server.exe svchost.exe PID 1088 wrote to memory of 380 1088 server.exe svchost.exe PID 1088 wrote to memory of 380 1088 server.exe svchost.exe PID 1088 wrote to memory of 1004 1088 server.exe explorer.exe PID 1088 wrote to memory of 1004 1088 server.exe explorer.exe PID 1088 wrote to memory of 1004 1088 server.exe explorer.exe PID 1088 wrote to memory of 380 1088 server.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\server.exe"C:\server.exe"2⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
-
C:\Wolfteam++.exe"C:\Wolfteam++.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Wolfteam++.exeFilesize
127KB
MD5a33d838a724bdb6c4776c83cade05c8d
SHA11d461f8ce81fd9158206087257b4141e4210d589
SHA256c87f6de3b8d6d0c21c3c3270322688199d1ca583f470f1ccf9a12c4326b745df
SHA512d5e0628bef30ef699ce61501d7dd05eecc96a531dea471e8abd889bccfa1e71fb2e07e01cb70402546cdbe16c812a49a3c71f20846dfa6f5de1eb3b45b58c0a1
-
C:\server.exeFilesize
44KB
MD5a32d0301ec441c45da2e43061fa602b9
SHA1cdb3fadd221c522141c927695f3d42eb5f579c16
SHA256c7f4a0c976caa8f3b5a79bdd3235d0108a2670e6e6f2a412aa0d6fb7d3c6120a
SHA512c18d9e6468e149f7c525ce64965324e62f2ce6df37138ce1a4401fde227bbbd61600c9947fce477759ad82e634bedd70bb7a6de4e6014338708bff06e88ff18d
-
memory/380-32-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/380-37-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/380-36-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/1088-34-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2148-26-0x0000000005790000-0x0000000005D34000-memory.dmpFilesize
5.6MB
-
memory/2148-30-0x00000000051D0000-0x00000000051E0000-memory.dmpFilesize
64KB
-
memory/2148-31-0x0000000005370000-0x000000000537A000-memory.dmpFilesize
40KB
-
memory/2148-29-0x00000000051E0000-0x0000000005272000-memory.dmpFilesize
584KB
-
memory/2148-33-0x00000000051D0000-0x00000000051E0000-memory.dmpFilesize
64KB
-
memory/2148-19-0x00000000750F0000-0x00000000758A0000-memory.dmpFilesize
7.7MB
-
memory/2148-18-0x00000000008B0000-0x00000000008D3000-memory.dmpFilesize
140KB
-
memory/2148-38-0x00000000750F0000-0x00000000758A0000-memory.dmpFilesize
7.7MB
-
memory/2148-39-0x00000000051D0000-0x00000000051E0000-memory.dmpFilesize
64KB
-
memory/2148-40-0x00000000051D0000-0x00000000051E0000-memory.dmpFilesize
64KB
-
memory/4108-27-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB