Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-07-2024 09:06

General

  • Target

    56b267dda810861979f650e344f25178_JaffaCakes118.exe

  • Size

    48KB

  • MD5

    56b267dda810861979f650e344f25178

  • SHA1

    a4269859e1fedb01a0102290ba799b57facfafbe

  • SHA256

    111bbaf6abb1f24166f5b247e4eeb430d725aa63fcf484536556c5941355b235

  • SHA512

    ffcdfdb7f4b7c3cb0004283a67d39c5205a10a907a78b7170a3d6ec99fa6fa0fe7c837c9d12b64c602677a630459126a0a9270e7555e520b9d40a48ec8679c6a

  • SSDEEP

    768:hIsF81fG9QveLOYTe5YioLHVR2jhi+O+l7kHn8lLmljnn/R9eKw5bifc1TK42idK:hIsFw9veLJToSHX2kR+l768laljn5i7Y

Malware Config

Signatures

  • Detect XtremeRAT payload 1 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56b267dda810861979f650e344f25178_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\56b267dda810861979f650e344f25178_JaffaCakes118.exe"
    1⤵
      PID:4940
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 224
        2⤵
        • Program crash
        PID:1892
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4940 -ip 4940
      1⤵
        PID:4360

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4940-0-0x0000000000C80000-0x0000000000C9C000-memory.dmp

        Filesize

        112KB

      • memory/4940-1-0x0000000000C80000-0x0000000000C9C000-memory.dmp

        Filesize

        112KB