Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 17:01
Static task
static1
Behavioral task
behavioral1
Sample
f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe
-
Size
89KB
-
MD5
f64105225170d5d38119d404fdddb7f7
-
SHA1
da21086ac37f205e0172df3b01e3240d8dbf3c71
-
SHA256
f8be8210805905d446fe4200fb72ae278b02fe96d1a50745d6d7b1bdcee94723
-
SHA512
2a3526250e830c407d4c6b3f6db0cd24808767f560678ec7854a44d7a386f9746704f221d6cb365d0386987b9061730133743a4f4856e38b2af8affe225c6b70
-
SSDEEP
1536:2XSJGKVKde7IPwZZlPiBiQqPgPL1TX9S23m51SK1LA4F2IzbQ:2eGWEeMPwZ7Pi/RSxSK5F2mQ
Malware Config
Extracted
xtremerat
wer99.no-ip.org
Signatures
-
Detect XtremeRAT payload 9 IoCs
Processes:
resource yara_rule behavioral2/memory/2372-2-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/2372-3-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/2372-4-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/2372-5-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/2368-6-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/2372-9-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/2372-10-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/2368-11-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/2372-12-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{D272T3CC-8BGE-IQQN-X2AN-T2J13JI3TPH1} f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D272T3CC-8BGE-IQQN-X2AN-T2J13JI3TPH1}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart" f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Program Files (x86)\\InstallDir\\Server.exe" f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Program Files (x86)\\InstallDir\\Server.exe" f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exedescription pid process target process PID 3580 set thread context of 2372 3580 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe -
Drops file in Program Files directory 3 IoCs
Processes:
f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\InstallDir\Server.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe File created C:\Program Files (x86)\InstallDir\Server.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\InstallDir\ f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 5112 2368 WerFault.exe svchost.exe 4420 2368 WerFault.exe svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exef64105225170d5d38119d404fdddb7f7_JaffaCakes118.exepid process 3580 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe 2372 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exef64105225170d5d38119d404fdddb7f7_JaffaCakes118.exedescription pid process target process PID 3580 wrote to memory of 2372 3580 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe PID 3580 wrote to memory of 2372 3580 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe PID 3580 wrote to memory of 2372 3580 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe PID 3580 wrote to memory of 2372 3580 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe PID 3580 wrote to memory of 2372 3580 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe PID 3580 wrote to memory of 2372 3580 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe PID 3580 wrote to memory of 2372 3580 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe PID 3580 wrote to memory of 2372 3580 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe PID 3580 wrote to memory of 2372 3580 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe PID 3580 wrote to memory of 2372 3580 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe PID 3580 wrote to memory of 2372 3580 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe PID 3580 wrote to memory of 2372 3580 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe PID 3580 wrote to memory of 2372 3580 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe PID 2372 wrote to memory of 2368 2372 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe svchost.exe PID 2372 wrote to memory of 2368 2372 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe svchost.exe PID 2372 wrote to memory of 2368 2372 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe svchost.exe PID 2372 wrote to memory of 2368 2372 f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\f64105225170d5d38119d404fdddb7f7_JaffaCakes118.exe
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:2368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 4884⤵
- Program crash
PID:5112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 5164⤵
- Program crash
PID:4420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2368 -ip 23681⤵PID:1996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2368 -ip 23681⤵PID:468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2368-6-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2368-11-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2372-2-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2372-3-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2372-4-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2372-5-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2372-9-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2372-10-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2372-12-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB