Analysis
-
max time kernel
140s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 21:18
Static task
static1
Behavioral task
behavioral1
Sample
54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe
-
Size
249KB
-
MD5
54d36d7af43725550fdd099ea1efd443
-
SHA1
4fb5178727a10fe58bdfbf1c3628e3a9e1c69d9a
-
SHA256
e1b5864fad55155ea7d5f2cce750927ed1c027a675e775a9a67db8c0d3b50da8
-
SHA512
d8406d336352ebe9c6f4ecbb829386a3f716beb81890696c2a144b879cd3cbeafad3811d3b0564b98497434f2c16309a4c2059ad6ad3d3ec8aca1011d8367d7f
-
SSDEEP
6144:85r1lTtmuoca6EBp27UMTqGC+xZQ5p7IN:OzTtmuoca6cp4ql+Sp
Malware Config
Extracted
xtremerat
claud222.no-ip.biz
✦㔘踀Partiesclaud222.no-ip.biz
Signatures
-
Detect XtremeRAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3468-9-0x0000000010000000-0x00000000100C3000-memory.dmp family_xtremerat behavioral2/memory/3468-7-0x0000000010000000-0x00000000100C3000-memory.dmp family_xtremerat behavioral2/memory/3128-10-0x0000000010000000-0x00000000100C3000-memory.dmp family_xtremerat behavioral2/memory/3468-11-0x0000000010000000-0x00000000100C3000-memory.dmp family_xtremerat behavioral2/memory/3128-12-0x0000000010000000-0x00000000100C3000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Processes:
resource yara_rule behavioral2/memory/3468-3-0x0000000010000000-0x00000000100C3000-memory.dmp upx behavioral2/memory/3468-6-0x0000000010000000-0x00000000100C3000-memory.dmp upx behavioral2/memory/3468-9-0x0000000010000000-0x00000000100C3000-memory.dmp upx behavioral2/memory/3468-7-0x0000000010000000-0x00000000100C3000-memory.dmp upx behavioral2/memory/3128-10-0x0000000010000000-0x00000000100C3000-memory.dmp upx behavioral2/memory/3468-11-0x0000000010000000-0x00000000100C3000-memory.dmp upx behavioral2/memory/3128-12-0x0000000010000000-0x00000000100C3000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exedescription pid Process procid_target PID 3784 set thread context of 3468 3784 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 91 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target Process procid_target 2536 3128 WerFault.exe 92 5040 3128 WerFault.exe 92 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exedescription pid Process Token: SeDebugPrivilege 3784 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exedescription pid Process procid_target PID 3784 wrote to memory of 3468 3784 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 91 PID 3784 wrote to memory of 3468 3784 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 91 PID 3784 wrote to memory of 3468 3784 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 91 PID 3784 wrote to memory of 3468 3784 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 91 PID 3784 wrote to memory of 3468 3784 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 91 PID 3784 wrote to memory of 3468 3784 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 91 PID 3784 wrote to memory of 3468 3784 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 91 PID 3784 wrote to memory of 3468 3784 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 91 PID 3468 wrote to memory of 3128 3468 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 92 PID 3468 wrote to memory of 3128 3468 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 92 PID 3468 wrote to memory of 3128 3468 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 92 PID 3468 wrote to memory of 3128 3468 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 92 PID 3468 wrote to memory of 1296 3468 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 93 PID 3468 wrote to memory of 1296 3468 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 93 PID 3468 wrote to memory of 1296 3468 54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:3128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 4844⤵
- Program crash
PID:2536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 4924⤵
- Program crash
PID:5040
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:1296
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3128 -ip 31281⤵PID:1840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3128 -ip 31281⤵PID:3588