Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18-07-2024 09:06

General

  • Target

    56b267dda810861979f650e344f25178_JaffaCakes118.exe

  • Size

    48KB

  • MD5

    56b267dda810861979f650e344f25178

  • SHA1

    a4269859e1fedb01a0102290ba799b57facfafbe

  • SHA256

    111bbaf6abb1f24166f5b247e4eeb430d725aa63fcf484536556c5941355b235

  • SHA512

    ffcdfdb7f4b7c3cb0004283a67d39c5205a10a907a78b7170a3d6ec99fa6fa0fe7c837c9d12b64c602677a630459126a0a9270e7555e520b9d40a48ec8679c6a

  • SSDEEP

    768:hIsF81fG9QveLOYTe5YioLHVR2jhi+O+l7kHn8lLmljnn/R9eKw5bifc1TK42idK:hIsFw9veLJToSHX2kR+l768laljn5i7Y

Malware Config

Signatures

  • Detect XtremeRAT payload 1 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56b267dda810861979f650e344f25178_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\56b267dda810861979f650e344f25178_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 36
      2⤵
      • Program crash
      PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1544-0-0x0000000000C80000-0x0000000000C9C000-memory.dmp

    Filesize

    112KB