Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 15:59
Static task
static1
Behavioral task
behavioral1
Sample
fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
-
Size
167KB
-
MD5
fd203670a1093f4efd07d570cf4ffee7
-
SHA1
04e4ff6219d57cab37db772130b7ec1ad8087e51
-
SHA256
9d162ad483c6ce5c325a3ca5329e4ca110c40d8b0595fa58bc3dc2db0ab47661
-
SHA512
3bf5583beba5e7d2c2bbedbef7679803b3b1963fb16da2d4891ee5ea8c1235a16756264608c4a18a24712e870e36fd142261bef00d4f619320cd305d5ebd5051
-
SSDEEP
3072:4xlgiukdSZJEpJnohdEJ1MtAe7gn17/C7fyWNCHeODrIN1xuAlWH:Klgil8egEJzqb/4Qxu2WH
Malware Config
Signatures
-
Detect XtremeRAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2144-7-0x0000000000C80000-0x0000000000C9C000-memory.dmp family_xtremerat behavioral1/memory/2144-8-0x0000000000C80000-0x0000000000C9C000-memory.dmp family_xtremerat behavioral1/memory/1100-14-0x0000000000C80000-0x0000000000C9C000-memory.dmp family_xtremerat behavioral1/memory/2144-22-0x0000000000C80000-0x0000000000C9C000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe -
Deletes itself 1 IoCs
Processes:
explorer.exepid process 1100 explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
Server.exepid process 2588 Server.exe -
Loads dropped DLL 2 IoCs
Processes:
fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exepid process 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/2144-3-0x0000000000C80000-0x0000000000C9C000-memory.dmp upx behavioral1/memory/2144-7-0x0000000000C80000-0x0000000000C9C000-memory.dmp upx behavioral1/memory/2144-6-0x0000000000C80000-0x0000000000C9C000-memory.dmp upx behavioral1/memory/2144-8-0x0000000000C80000-0x0000000000C9C000-memory.dmp upx behavioral1/memory/1100-14-0x0000000000C80000-0x0000000000C9C000-memory.dmp upx behavioral1/memory/2144-22-0x0000000000C80000-0x0000000000C9C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exedescription pid process target process PID 2032 set thread context of 2144 2032 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
Processes:
fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exedescription ioc process File created C:\Windows\InstallDir\Server.exe fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe File opened for modification C:\Windows\InstallDir\Server.exe fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exeServer.exepid process 2032 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe 2032 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe 2588 Server.exe 2588 Server.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exefd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exedescription pid process target process PID 2032 wrote to memory of 2144 2032 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe PID 2032 wrote to memory of 2144 2032 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe PID 2032 wrote to memory of 2144 2032 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe PID 2032 wrote to memory of 2144 2032 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe PID 2032 wrote to memory of 2144 2032 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe PID 2032 wrote to memory of 2144 2032 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe PID 2144 wrote to memory of 2152 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2152 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2152 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2152 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 1100 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe explorer.exe PID 2144 wrote to memory of 1100 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe explorer.exe PID 2144 wrote to memory of 1100 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe explorer.exe PID 2144 wrote to memory of 1100 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe explorer.exe PID 2144 wrote to memory of 1100 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe explorer.exe PID 2144 wrote to memory of 2152 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2564 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2564 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2564 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2564 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2564 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2652 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2652 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2652 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2652 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2652 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2468 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2468 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2468 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2468 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2468 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2200 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2200 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2200 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2200 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2200 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2856 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2856 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2856 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2856 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2856 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 1036 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 1036 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 1036 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 1036 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 1036 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2504 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2504 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2504 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2504 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe iexplore.exe PID 2144 wrote to memory of 2588 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe Server.exe PID 2144 wrote to memory of 2588 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe Server.exe PID 2144 wrote to memory of 2588 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe Server.exe PID 2144 wrote to memory of 2588 2144 fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe Server.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe"2⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Deletes itself
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\InstallDir\Server.exeFilesize
167KB
MD5fd203670a1093f4efd07d570cf4ffee7
SHA104e4ff6219d57cab37db772130b7ec1ad8087e51
SHA2569d162ad483c6ce5c325a3ca5329e4ca110c40d8b0595fa58bc3dc2db0ab47661
SHA5123bf5583beba5e7d2c2bbedbef7679803b3b1963fb16da2d4891ee5ea8c1235a16756264608c4a18a24712e870e36fd142261bef00d4f619320cd305d5ebd5051
-
memory/1100-14-0x0000000000C80000-0x0000000000C9C000-memory.dmpFilesize
112KB
-
memory/2032-4-0x0000000010000000-0x0000000010021000-memory.dmpFilesize
132KB
-
memory/2144-0-0x0000000000C80000-0x0000000000C9C000-memory.dmpFilesize
112KB
-
memory/2144-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2144-3-0x0000000000C80000-0x0000000000C9C000-memory.dmpFilesize
112KB
-
memory/2144-7-0x0000000000C80000-0x0000000000C9C000-memory.dmpFilesize
112KB
-
memory/2144-6-0x0000000000C80000-0x0000000000C9C000-memory.dmpFilesize
112KB
-
memory/2144-8-0x0000000000C80000-0x0000000000C9C000-memory.dmpFilesize
112KB
-
memory/2144-22-0x0000000000C80000-0x0000000000C9C000-memory.dmpFilesize
112KB
-
memory/2588-26-0x0000000010000000-0x0000000010021000-memory.dmpFilesize
132KB