Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
17-07-2024 19:36
Static task
static1
Behavioral task
behavioral1
Sample
547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe
-
Size
66KB
-
MD5
547846eaecf08317d469425b55f2e86a
-
SHA1
ad53ba5cbce1111d986db7eb2a275f2cabcb271d
-
SHA256
d6edda1ae2c1570dbdb4573f7bd22d430b0f4199f107584dff9ccfe6c101bdf1
-
SHA512
1cb7e003ebb351604d711951a4d9c0fe7b8c7e42eb0e8c8730ec26a7d9f94b038edccdbe230cdc740387382708688087e94e2d5dacd32f0a80d984d46d44d9ec
-
SSDEEP
1536:34eQxz5mSgaNBMx08WdoMdYwAP+dsAeCAn82erA:oLN0Z/q8lMSwAPAsAPASA
Malware Config
Extracted
xtremerat
memozzz.no-ip.org
Signatures
-
Detect XtremeRAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2732-29-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/2884-32-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/2712-35-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/2712-37-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/2884-39-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/2712-40-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
svchost.exesvchost.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{YWF5FRIT-ABW6-JN88-4310-5FP7P1207K75} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{YWF5FRIT-ABW6-JN88-4310-5FP7P1207K75}\StubPath = "C:\\Windows\\system32\\WINEPDAT\\WINEPDATEr.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{YWF5FRIT-ABW6-JN88-4310-5FP7P1207K75} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{YWF5FRIT-ABW6-JN88-4310-5FP7P1207K75}\StubPath = "C:\\Windows\\system32\\WINEPDAT\\WINEPDATEr.exe" svchost.exe -
Processes:
resource yara_rule behavioral1/memory/2732-23-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral1/memory/2732-29-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral1/memory/2732-28-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral1/memory/2884-32-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral1/memory/2712-35-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral1/memory/2712-37-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral1/memory/2884-39-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral1/memory/2712-40-0x0000000010000000-0x0000000010048000-memory.dmp upx -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
svchost.exesvchost.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WINEPDAT\\WINEPDATEr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WINEPDAT\\WINEPDATEr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "㩃坜湩潤獷卜獹佗㙗尴癳档獯\u2e74硥e엸က엸က㽜" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WINEPDAT\\WINEPDATEr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WINEPDAT\\WINEPDATEr.exe" svchost.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\WINEPDAT\WINEPDATEr.exe svchost.exe File created C:\Windows\SysWOW64\WINEPDAT\WINEPDATEr.exe svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe547846eaecf08317d469425b55f2e86a_JaffaCakes118.exedescription pid Process procid_target PID 1188 set thread context of 2696 1188 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 30 PID 2696 set thread context of 2732 2696 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
547846eaecf08317d469425b55f2e86a_JaffaCakes118.exesvchost.exepid Process 2696 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 2712 svchost.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe547846eaecf08317d469425b55f2e86a_JaffaCakes118.exedescription pid Process procid_target PID 1188 wrote to memory of 2696 1188 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 30 PID 1188 wrote to memory of 2696 1188 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 30 PID 1188 wrote to memory of 2696 1188 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 30 PID 1188 wrote to memory of 2696 1188 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 30 PID 1188 wrote to memory of 2696 1188 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 30 PID 1188 wrote to memory of 2696 1188 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 30 PID 1188 wrote to memory of 2696 1188 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 30 PID 1188 wrote to memory of 2696 1188 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 30 PID 1188 wrote to memory of 2696 1188 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 30 PID 2696 wrote to memory of 2732 2696 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2732 2696 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2732 2696 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2732 2696 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2732 2696 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2732 2696 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2732 2696 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2732 2696 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2732 2696 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 31 PID 2732 wrote to memory of 2884 2732 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 32 PID 2732 wrote to memory of 2884 2732 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 32 PID 2732 wrote to memory of 2884 2732 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 32 PID 2732 wrote to memory of 2884 2732 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 32 PID 2732 wrote to memory of 2884 2732 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 32 PID 2732 wrote to memory of 2712 2732 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 33 PID 2732 wrote to memory of 2712 2732 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 33 PID 2732 wrote to memory of 2712 2732 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 33 PID 2732 wrote to memory of 2712 2732 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 33 PID 2732 wrote to memory of 2712 2732 547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\547846eaecf08317d469425b55f2e86a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\547846eaecf08317d469425b55f2e86a_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
PID:2884
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2712
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5547846eaecf08317d469425b55f2e86a
SHA1ad53ba5cbce1111d986db7eb2a275f2cabcb271d
SHA256d6edda1ae2c1570dbdb4573f7bd22d430b0f4199f107584dff9ccfe6c101bdf1
SHA5121cb7e003ebb351604d711951a4d9c0fe7b8c7e42eb0e8c8730ec26a7d9f94b038edccdbe230cdc740387382708688087e94e2d5dacd32f0a80d984d46d44d9ec