Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 07:44
Static task
static1
Behavioral task
behavioral1
Sample
3c86a83b901a641312995646344e53ee_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3c86a83b901a641312995646344e53ee_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3c86a83b901a641312995646344e53ee_JaffaCakes118.exe
-
Size
236KB
-
MD5
3c86a83b901a641312995646344e53ee
-
SHA1
a08ef7325e84096681985fe5d335c8ddc03774fd
-
SHA256
90c4738f5ae5712cd9db758cbca2653703737020ab270e0c7be3b66a99bcad5c
-
SHA512
73b5258297d4c381a79c91894a3e8fc39902825d4ed4ae1e0d24b898d2814bc3b033b4c9055b1314e68950fc93df3b7386fc99c489319cfaba2f7ce8cdb7aac7
-
SSDEEP
3072:YAWua0nb7M0t5DPmV152Fh/neAnIoc+KMslxcXhKzQwIWbFj2NfPTaHslLrWnR5z:RRRTmV152Fh/neA2C5I5Sn+B2NyZ
Malware Config
Extracted
xtremerat
eminn115.zapto.org
Signatures
-
Detect XtremeRAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2928-10-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/2928-11-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/2696-14-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/2928-18-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/2620-17-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/2620-21-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/2620-20-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/2696-23-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/2620-24-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
explorer.exesvchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{CI4KWQ8U-684P-0W58-UL84-IAJ80Q274J8N} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CI4KWQ8U-684P-0W58-UL84-IAJ80Q274J8N}\StubPath = "C:\\Windows\\system32\\InstallDir\\svchost.exe restart" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{CI4KWQ8U-684P-0W58-UL84-IAJ80Q274J8N} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CI4KWQ8U-684P-0W58-UL84-IAJ80Q274J8N}\StubPath = "C:\\Windows\\system32\\InstallDir\\svchost.exe" svchost.exe -
Processes:
resource yara_rule behavioral1/memory/2928-7-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2928-4-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2928-3-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2928-9-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2928-10-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2928-11-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2696-14-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2928-18-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2620-17-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2620-21-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2620-20-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2696-23-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2620-24-0x0000000010000000-0x000000001004D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\svchost.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\svchost.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\svchost.exe" svchost.exe -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\SysWOW64\InstallDir\svchost.exe explorer.exe File created C:\Windows\SysWOW64\InstallDir\svchost.exe explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3c86a83b901a641312995646344e53ee_JaffaCakes118.exedescription pid process target process PID 2776 set thread context of 2928 2776 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3c86a83b901a641312995646344e53ee_JaffaCakes118.exeexplorer.exepid process 2776 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe 2620 explorer.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
3c86a83b901a641312995646344e53ee_JaffaCakes118.exe3c86a83b901a641312995646344e53ee_JaffaCakes118.exedescription pid process target process PID 2776 wrote to memory of 2928 2776 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe PID 2776 wrote to memory of 2928 2776 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe PID 2776 wrote to memory of 2928 2776 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe PID 2776 wrote to memory of 2928 2776 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe PID 2776 wrote to memory of 2928 2776 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe PID 2776 wrote to memory of 2928 2776 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe PID 2776 wrote to memory of 2928 2776 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe PID 2776 wrote to memory of 2928 2776 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe PID 2928 wrote to memory of 2696 2928 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe svchost.exe PID 2928 wrote to memory of 2696 2928 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe svchost.exe PID 2928 wrote to memory of 2696 2928 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe svchost.exe PID 2928 wrote to memory of 2696 2928 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe svchost.exe PID 2928 wrote to memory of 2696 2928 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe svchost.exe PID 2928 wrote to memory of 2620 2928 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe explorer.exe PID 2928 wrote to memory of 2620 2928 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe explorer.exe PID 2928 wrote to memory of 2620 2928 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe explorer.exe PID 2928 wrote to memory of 2620 2928 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe explorer.exe PID 2928 wrote to memory of 2620 2928 3c86a83b901a641312995646344e53ee_JaffaCakes118.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c86a83b901a641312995646344e53ee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c86a83b901a641312995646344e53ee_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3c86a83b901a641312995646344e53ee_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3c86a83b901a641312995646344e53ee_JaffaCakes118.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
PID:2696 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD53c86a83b901a641312995646344e53ee
SHA1a08ef7325e84096681985fe5d335c8ddc03774fd
SHA25690c4738f5ae5712cd9db758cbca2653703737020ab270e0c7be3b66a99bcad5c
SHA51273b5258297d4c381a79c91894a3e8fc39902825d4ed4ae1e0d24b898d2814bc3b033b4c9055b1314e68950fc93df3b7386fc99c489319cfaba2f7ce8cdb7aac7