Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-04-2024 10:54

General

  • Target

    f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe

  • Size

    211KB

  • MD5

    f0e35d7526ac18475f1cfcdd6c772a8c

  • SHA1

    525a6d099216ae252d803f0e47806a55621e6d9e

  • SHA256

    b9021561415bff1468c140ce32431baf1ee6f94aeacf450634f2b76232055438

  • SHA512

    923ccad09ede28890165792c9229076ba55683efb989da85dea14048abed45abd8ca40af77d4a086f5701daabbcc6da415e0c737bb98029dfcf411b2a0c3ab0a

  • SSDEEP

    6144:dqZ7oEYoRAQaUbRZH+CHRSwI7PTn422b4HuwIAXbPZcry+wNKevSK0b4EeU:da7TFUUbRMCf

Malware Config

Extracted

Family

xtremerat

C2

abcdgl.mooo.com

88.net

ƁᏘ캸glhacker.zapto.org

glhacwthackupdate.no-ip.biz

ƁᏘ캸winrarsfx.linkpc.net

winraabcdgl.mooo.com

.net

Signatures

  • Detect XtremeRAT payload 7 IoCs
  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Adds policy Run key to start application 2 TTPs 8 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4824
    • C:\server.exe
      "C:\server.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • Modifies WinLogon for persistence
        • Adds policy Run key to start application
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        PID:4108
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:380
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe
        3⤵
          PID:1004
      • C:\Wolfteam++.exe
        "C:\Wolfteam++.exe"
        2⤵
        • Executes dropped EXE
        PID:2148

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Boot or Logon Autostart Execution

    4
    T1547

    Registry Run Keys / Startup Folder

    3
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Privilege Escalation

    Boot or Logon Autostart Execution

    4
    T1547

    Registry Run Keys / Startup Folder

    3
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Defense Evasion

    Modify Registry

    4
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Wolfteam++.exe
      Filesize

      127KB

      MD5

      a33d838a724bdb6c4776c83cade05c8d

      SHA1

      1d461f8ce81fd9158206087257b4141e4210d589

      SHA256

      c87f6de3b8d6d0c21c3c3270322688199d1ca583f470f1ccf9a12c4326b745df

      SHA512

      d5e0628bef30ef699ce61501d7dd05eecc96a531dea471e8abd889bccfa1e71fb2e07e01cb70402546cdbe16c812a49a3c71f20846dfa6f5de1eb3b45b58c0a1

    • C:\server.exe
      Filesize

      44KB

      MD5

      a32d0301ec441c45da2e43061fa602b9

      SHA1

      cdb3fadd221c522141c927695f3d42eb5f579c16

      SHA256

      c7f4a0c976caa8f3b5a79bdd3235d0108a2670e6e6f2a412aa0d6fb7d3c6120a

      SHA512

      c18d9e6468e149f7c525ce64965324e62f2ce6df37138ce1a4401fde227bbbd61600c9947fce477759ad82e634bedd70bb7a6de4e6014338708bff06e88ff18d

    • memory/380-32-0x0000000000C80000-0x0000000000C93000-memory.dmp
      Filesize

      76KB

    • memory/380-37-0x0000000000C80000-0x0000000000C93000-memory.dmp
      Filesize

      76KB

    • memory/380-36-0x0000000000C80000-0x0000000000C93000-memory.dmp
      Filesize

      76KB

    • memory/1088-34-0x0000000000C80000-0x0000000000C93000-memory.dmp
      Filesize

      76KB

    • memory/2148-26-0x0000000005790000-0x0000000005D34000-memory.dmp
      Filesize

      5.6MB

    • memory/2148-30-0x00000000051D0000-0x00000000051E0000-memory.dmp
      Filesize

      64KB

    • memory/2148-31-0x0000000005370000-0x000000000537A000-memory.dmp
      Filesize

      40KB

    • memory/2148-29-0x00000000051E0000-0x0000000005272000-memory.dmp
      Filesize

      584KB

    • memory/2148-33-0x00000000051D0000-0x00000000051E0000-memory.dmp
      Filesize

      64KB

    • memory/2148-19-0x00000000750F0000-0x00000000758A0000-memory.dmp
      Filesize

      7.7MB

    • memory/2148-18-0x00000000008B0000-0x00000000008D3000-memory.dmp
      Filesize

      140KB

    • memory/2148-38-0x00000000750F0000-0x00000000758A0000-memory.dmp
      Filesize

      7.7MB

    • memory/2148-39-0x00000000051D0000-0x00000000051E0000-memory.dmp
      Filesize

      64KB

    • memory/2148-40-0x00000000051D0000-0x00000000051E0000-memory.dmp
      Filesize

      64KB

    • memory/4108-27-0x0000000000C80000-0x0000000000C93000-memory.dmp
      Filesize

      76KB