Malware Analysis Report

2024-12-07 21:59

Sample ID 240716-x1hexawdmm
Target 4fb0474a5138af4786995d6c23572c5c_JaffaCakes118
SHA256 1e1245c74250df5554ba0e39c09d75284a8ca71402dcdb7dd27df2a6816d3dee
Tags
xtremerat persistence rat spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1e1245c74250df5554ba0e39c09d75284a8ca71402dcdb7dd27df2a6816d3dee

Threat Level: Known bad

The file 4fb0474a5138af4786995d6c23572c5c_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

xtremerat persistence rat spyware

XtremeRAT

Detect XtremeRAT payload

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Enumerates physical storage devices

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-16 19:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-16 19:19

Reported

2024-07-16 19:21

Platform

win7-20240704-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe"

Signatures

Detect XtremeRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XtremeRAT

persistence spyware rat xtremerat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\process32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\GAnZPmGNII = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tempfile.exe\"" C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2224 set thread context of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2224 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2224 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2224 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2224 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2224 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2224 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2224 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2224 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2224 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2224 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2224 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2224 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\process32.exe

C:\Users\Admin\AppData\Local\Temp\\process32.exe

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}

Network

N/A

Files

memory/2224-0-0x0000000074E91000-0x0000000074E92000-memory.dmp

memory/2224-1-0x0000000074E90000-0x000000007543B000-memory.dmp

memory/2224-2-0x0000000074E90000-0x000000007543B000-memory.dmp

memory/2796-13-0x0000000000C80000-0x0000000000CC1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\process32.exe

MD5 d2ed8fa3208e702b7d61728af768eed1
SHA1 54094aa272cb866a46c2ca5b56f4a094e0f48ffb
SHA256 9236208e312b2f47a0ef40e59fc0f364fc8e401717e1e46555c26bec8ab3de1f
SHA512 42442dc0b98f2abaea0c6516602d80df8a2a680278ecdc2b96fe5ce44685f7442347fd4ad13d9d99e0330cf0be7c0e9bbf22bd78c0173066221e430203c76313

memory/2796-19-0x0000000000C80000-0x0000000000CC1000-memory.dmp

memory/2796-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2796-16-0x0000000000C80000-0x0000000000CC1000-memory.dmp

memory/2796-15-0x0000000000C80000-0x0000000000CC1000-memory.dmp

memory/2796-14-0x0000000000C80000-0x0000000000CC1000-memory.dmp

memory/2796-12-0x0000000000C80000-0x0000000000CC1000-memory.dmp

memory/2796-10-0x0000000000C80000-0x0000000000CC1000-memory.dmp

memory/2796-11-0x0000000000C80000-0x0000000000CC1000-memory.dmp

memory/2224-23-0x0000000000BF0000-0x0000000000BF2000-memory.dmp

memory/2748-24-0x0000000000180000-0x0000000000182000-memory.dmp

memory/2748-25-0x00000000002B0000-0x00000000002B1000-memory.dmp

memory/2224-26-0x0000000074E90000-0x000000007543B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2549_Scarface_.jpg

MD5 d62cbdd76e9de3c59ea603580c2f2f41
SHA1 68d79ce4db76285c95dd5eab04f045aa10d9965f
SHA256 db4fbe4f23607402ba6ffea18f1e933c69a2c53f7e973f9b31226705bf538259
SHA512 02bd77d394c07fc6ca935886a68f13065e507c9c75340f44884c44469bd406bcab9bfec65d14adb925bd3c6dce2ab67206ea99eabfc73c1e3718f48a63ec13aa

memory/2748-28-0x00000000002B0000-0x00000000002B1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-16 19:19

Reported

2024-07-16 19:21

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe"

Signatures

Detect XtremeRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

XtremeRAT

persistence spyware rat xtremerat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\process32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wBDuVFwsXX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tempfile.exe\"" C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2684 set thread context of 4860 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\process32.exe

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2684 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2684 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2684 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2684 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2684 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2684 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2684 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2684 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2684 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2684 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2684 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2684 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2684 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\process32.exe
PID 2684 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2684 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2684 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4fb0474a5138af4786995d6c23572c5c_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\process32.exe

C:\Users\Admin\AppData\Local\Temp\\process32.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4860 -ip 4860

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 964

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 12

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 233.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/2684-0-0x0000000074722000-0x0000000074723000-memory.dmp

memory/2684-1-0x0000000074720000-0x0000000074CD1000-memory.dmp

memory/2684-2-0x0000000074720000-0x0000000074CD1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\process32.exe

MD5 d2ed8fa3208e702b7d61728af768eed1
SHA1 54094aa272cb866a46c2ca5b56f4a094e0f48ffb
SHA256 9236208e312b2f47a0ef40e59fc0f364fc8e401717e1e46555c26bec8ab3de1f
SHA512 42442dc0b98f2abaea0c6516602d80df8a2a680278ecdc2b96fe5ce44685f7442347fd4ad13d9d99e0330cf0be7c0e9bbf22bd78c0173066221e430203c76313

memory/4860-5-0x0000000000C80000-0x0000000000CC1000-memory.dmp

memory/2684-15-0x0000000074720000-0x0000000074CD1000-memory.dmp