Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 15:56
Behavioral task
behavioral1
Sample
53b4bc9808d5fde7254bee722d058147_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
53b4bc9808d5fde7254bee722d058147_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
53b4bc9808d5fde7254bee722d058147_JaffaCakes118.exe
-
Size
130KB
-
MD5
53b4bc9808d5fde7254bee722d058147
-
SHA1
e7023923e1f16aab961480c4b6b9af2ac12eacc9
-
SHA256
979f0baf3ec1bacce743a289abe5acdabbde9e7a588ac2b4e419042dde95df1c
-
SHA512
f425754608e58543daf198a4081b6cb26d64890b0186a250dd6588ae082f961ccefd03e8700b1ecb80466baff06bbdfad390a0d8f343ad44a220751642f3a017
-
SSDEEP
3072:s44rjMWpRo+ojwmcpHjJwij/7wXkiRk3Hi:HIpROjAdtwijEHRkXi
Malware Config
Extracted
xtremerat
gomaa312.no-ip.info
Signatures
-
Detect XtremeRAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/464-0-0x0000000010000000-0x0000000010067000-memory.dmp family_xtremerat behavioral2/memory/464-1-0x0000000010000000-0x0000000010067000-memory.dmp family_xtremerat behavioral2/memory/464-3-0x0000000010001000-0x000000001000E000-memory.dmp family_xtremerat behavioral2/memory/792-4-0x0000000010000000-0x0000000010067000-memory.dmp family_xtremerat behavioral2/memory/464-5-0x0000000010000000-0x0000000010067000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target Process procid_target 2008 792 WerFault.exe 84 4368 792 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
53b4bc9808d5fde7254bee722d058147_JaffaCakes118.exedescription pid Process procid_target PID 464 wrote to memory of 792 464 53b4bc9808d5fde7254bee722d058147_JaffaCakes118.exe 84 PID 464 wrote to memory of 792 464 53b4bc9808d5fde7254bee722d058147_JaffaCakes118.exe 84 PID 464 wrote to memory of 792 464 53b4bc9808d5fde7254bee722d058147_JaffaCakes118.exe 84 PID 464 wrote to memory of 792 464 53b4bc9808d5fde7254bee722d058147_JaffaCakes118.exe 84 PID 464 wrote to memory of 4572 464 53b4bc9808d5fde7254bee722d058147_JaffaCakes118.exe 87 PID 464 wrote to memory of 4572 464 53b4bc9808d5fde7254bee722d058147_JaffaCakes118.exe 87 PID 464 wrote to memory of 4572 464 53b4bc9808d5fde7254bee722d058147_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\53b4bc9808d5fde7254bee722d058147_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\53b4bc9808d5fde7254bee722d058147_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\ctfmon.exectfmon .exe2⤵PID:792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 3643⤵
- Program crash
PID:2008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 3723⤵
- Program crash
PID:4368
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4572
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 792 -ip 7921⤵PID:1980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 792 -ip 7921⤵PID:404