Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
17-07-2024 21:18
Static task
static1
Behavioral task
behavioral1
Sample
54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe
-
Size
249KB
-
MD5
54d36d7af43725550fdd099ea1efd443
-
SHA1
4fb5178727a10fe58bdfbf1c3628e3a9e1c69d9a
-
SHA256
e1b5864fad55155ea7d5f2cce750927ed1c027a675e775a9a67db8c0d3b50da8
-
SHA512
d8406d336352ebe9c6f4ecbb829386a3f716beb81890696c2a144b879cd3cbeafad3811d3b0564b98497434f2c16309a4c2059ad6ad3d3ec8aca1011d8367d7f
-
SSDEEP
6144:85r1lTtmuoca6EBp27UMTqGC+xZQ5p7IN:OzTtmuoca6cp4ql+Sp
Malware Config
Extracted
xtremerat
claud222.no-ip.biz
✦㔘踀Partiesclaud222.no-ip.biz
Signatures
-
Detect XtremeRAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1148-6-0x0000000010000000-0x00000000100C3000-memory.dmp family_xtremerat behavioral1/memory/1148-7-0x0000000010000000-0x00000000100C3000-memory.dmp family_xtremerat behavioral1/memory/1808-12-0x0000000010000000-0x00000000100C3000-memory.dmp family_xtremerat behavioral1/memory/1148-13-0x0000000010000000-0x00000000100C3000-memory.dmp family_xtremerat behavioral1/memory/1808-14-0x0000000010000000-0x00000000100C3000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Processes:
resource yara_rule behavioral1/memory/1148-3-0x0000000010000000-0x00000000100C3000-memory.dmp upx behavioral1/memory/1148-5-0x0000000010000000-0x00000000100C3000-memory.dmp upx behavioral1/memory/1148-6-0x0000000010000000-0x00000000100C3000-memory.dmp upx behavioral1/memory/1148-7-0x0000000010000000-0x00000000100C3000-memory.dmp upx behavioral1/memory/1808-12-0x0000000010000000-0x00000000100C3000-memory.dmp upx behavioral1/memory/1148-13-0x0000000010000000-0x00000000100C3000-memory.dmp upx behavioral1/memory/1808-14-0x0000000010000000-0x00000000100C3000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exedescription pid Process procid_target PID 2076 set thread context of 1148 2076 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exedescription pid Process Token: SeDebugPrivilege 2076 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exedescription pid Process procid_target PID 2076 wrote to memory of 1148 2076 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 30 PID 2076 wrote to memory of 1148 2076 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 30 PID 2076 wrote to memory of 1148 2076 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 30 PID 2076 wrote to memory of 1148 2076 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 30 PID 2076 wrote to memory of 1148 2076 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 30 PID 2076 wrote to memory of 1148 2076 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 30 PID 2076 wrote to memory of 1148 2076 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 30 PID 2076 wrote to memory of 1148 2076 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 30 PID 2076 wrote to memory of 1148 2076 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 30 PID 1148 wrote to memory of 1808 1148 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 31 PID 1148 wrote to memory of 1808 1148 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 31 PID 1148 wrote to memory of 1808 1148 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 31 PID 1148 wrote to memory of 1808 1148 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 31 PID 1148 wrote to memory of 1808 1148 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 31 PID 1148 wrote to memory of 2112 1148 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 32 PID 1148 wrote to memory of 2112 1148 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 32 PID 1148 wrote to memory of 2112 1148 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 32 PID 1148 wrote to memory of 2112 1148 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 32 PID 1148 wrote to memory of 2112 1148 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:1808
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2112
-
-