Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
01/07/2024, 10:50
General
- Target 1b01f00679c156aa7b90be894b5081d6_JaffaCakes118.exe
- Size 230KB
- Sample240701-mxgn4azhpk
- SHA256 1e1e2788a085a4feb4bfb33664e4df8c69d3f3b31d4782bbaae497a20e59a2bb
Malware Config
Extracted
-
xtremerat
-
mohamed.zapto.org
-
�%翿mohamed.zapto.org
Signatures
- Detect XtremeRAT payload 3 IoCs
- XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b01f00679c156aa7b90be894b5081d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1b01f00679c156aa7b90be894b5081d6_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 4803⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 5043⤵
- Program crash
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 460 -ip 4601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 460 -ip 4601⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/460-12-0x0000000010000000-0x000000001005B000-memory.dmp
memory/460-18-0x0000000075B70000-0x0000000075C60000-memory.dmp
memory/460-17-0x0000000010000000-0x000000001005B000-memory.dmp
memory/460-13-0x0000000075B70000-0x0000000075C60000-memory.dmp
memory/4840-6-0x00000000024E0000-0x00000000024F0000-memory.dmp
memory/4840-11-0x0000000075B70000-0x0000000075C60000-memory.dmp
memory/4840-4-0x0000000002290000-0x00000000022A0000-memory.dmp
memory/4840-3-0x00000000022F0000-0x0000000002300000-memory.dmp
memory/4840-2-0x0000000010000000-0x000000001005B000-memory.dmp
memory/4840-9-0x0000000075B70000-0x0000000075C60000-memory.dmp
memory/4840-10-0x0000000075B70000-0x0000000075C60000-memory.dmp
memory/4840-5-0x0000000077BB2000-0x0000000077BB3000-memory.dmp
memory/4840-0-0x0000000000680000-0x0000000000681000-memory.dmp
memory/4840-7-0x00000000024E0000-0x00000000024F0000-memory.dmp
memory/4840-14-0x0000000010000000-0x000000001005B000-memory.dmp
memory/4840-15-0x00000000006B0000-0x00000000006FE000-memory.dmp
memory/4840-16-0x0000000075B70000-0x0000000075C60000-memory.dmp
memory/4840-8-0x0000000075B90000-0x0000000075B91000-memory.dmp
memory/4840-1-0x00000000006B0000-0x00000000006FE000-memory.dmp