Malware Analysis Report

2024-12-07 21:34

Sample ID 240716-y47dwa1eqe
Target 4fe803090331cfcace587a8310a4bc26_JaffaCakes118
SHA256 29585e49ee0559e73c692ddaa8db2fb6512c5f46a8b7fc1d57c388da2ff79390
Tags
xtremerat persistence rat spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

29585e49ee0559e73c692ddaa8db2fb6512c5f46a8b7fc1d57c388da2ff79390

Threat Level: Known bad

The file 4fe803090331cfcace587a8310a4bc26_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

xtremerat persistence rat spyware

Detect XtremeRAT payload

XtremeRAT

Boot or Logon Autostart Execution: Active Setup

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-16 20:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-16 20:21

Reported

2024-07-16 20:24

Platform

win10v2004-20240709-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe"

Signatures

Detect XtremeRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

XtremeRAT

persistence spyware rat xtremerat

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8} C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8} C:\Windows\SysWOW64\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" C:\Windows\SysWOW64\svchost.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\InstallDir\Server.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InstallDir\Server.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4516 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 4516 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 4516 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 4516 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 4516 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 4516 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 4516 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 4516 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 4516 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 4516 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 4516 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 1660 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1660 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1660 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1660 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1660 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe

4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe

4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp

Files

memory/4516-0-0x00000000750B2000-0x00000000750B3000-memory.dmp

memory/4516-1-0x00000000750B0000-0x0000000075661000-memory.dmp

memory/4516-2-0x00000000750B0000-0x0000000075661000-memory.dmp

memory/1660-3-0x0000000000C80000-0x0000000000C98000-memory.dmp

memory/1660-6-0x0000000000C80000-0x0000000000C98000-memory.dmp

memory/4516-7-0x00000000750B0000-0x0000000075661000-memory.dmp

memory/3108-11-0x0000000000C80000-0x0000000000C98000-memory.dmp

C:\Windows\SysWOW64\InstallDir\Server.exe

MD5 4fe803090331cfcace587a8310a4bc26
SHA1 dc3a5c03a8e7c3509bc28846cec8bf1c555ac73d
SHA256 29585e49ee0559e73c692ddaa8db2fb6512c5f46a8b7fc1d57c388da2ff79390
SHA512 92a9dc6e84dace2826da39b356dbb36db0c422cd52f4f7d9e38a254dca38330e647899013d3ed6ebb33624eb86f929ab5cf2b11aa276827a063919f20e9984b1

memory/1660-14-0x0000000000C80000-0x0000000000C98000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-16 20:21

Reported

2024-07-16 20:24

Platform

win7-20240705-en

Max time kernel

146s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe"

Signatures

Detect XtremeRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XtremeRAT

persistence spyware rat xtremerat

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8} C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8} C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" C:\Windows\SysWOW64\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" C:\Windows\SysWOW64\svchost.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\InstallDir\Server.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InstallDir\Server.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2092 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 2092 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 2092 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 2092 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 2092 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 2092 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 2092 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 2092 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 2092 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 2092 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 2092 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 2092 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 2092 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe
PID 1952 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1952 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1952 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1952 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1952 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1952 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1952 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1952 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1952 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1952 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe

4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe

4fe803090331cfcace587a8310a4bc26_JaffaCakes118.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 biladi2000.no-ip.info udp

Files

memory/2092-0-0x0000000074451000-0x0000000074452000-memory.dmp

memory/2092-1-0x0000000074450000-0x00000000749FB000-memory.dmp

memory/2092-2-0x0000000074450000-0x00000000749FB000-memory.dmp

memory/1952-9-0x0000000000C80000-0x0000000000C98000-memory.dmp

memory/1952-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1952-6-0x0000000000C80000-0x0000000000C98000-memory.dmp

memory/1952-5-0x0000000000C80000-0x0000000000C98000-memory.dmp

memory/1952-4-0x0000000000C80000-0x0000000000C98000-memory.dmp

memory/1952-3-0x0000000000C80000-0x0000000000C98000-memory.dmp

memory/1952-11-0x0000000000C80000-0x0000000000C98000-memory.dmp

memory/2092-12-0x0000000074450000-0x00000000749FB000-memory.dmp

memory/2692-18-0x0000000000C80000-0x0000000000C98000-memory.dmp

C:\Windows\SysWOW64\InstallDir\Server.exe

MD5 4fe803090331cfcace587a8310a4bc26
SHA1 dc3a5c03a8e7c3509bc28846cec8bf1c555ac73d
SHA256 29585e49ee0559e73c692ddaa8db2fb6512c5f46a8b7fc1d57c388da2ff79390
SHA512 92a9dc6e84dace2826da39b356dbb36db0c422cd52f4f7d9e38a254dca38330e647899013d3ed6ebb33624eb86f929ab5cf2b11aa276827a063919f20e9984b1

memory/2988-22-0x0000000000C80000-0x0000000000C98000-memory.dmp

memory/2988-24-0x0000000000C80000-0x0000000000C98000-memory.dmp