Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18-07-2024 12:22

General

  • Target

    575be827aaf815b042eeb2f26256aa36_JaffaCakes118.exe

  • Size

    636KB

  • MD5

    575be827aaf815b042eeb2f26256aa36

  • SHA1

    0fbaac8c23c753087600ebb60d88156c0e879cf4

  • SHA256

    7482550afd104fb717817aa4a366e6f5c91377b1add23dd3ee4986b6283589c7

  • SHA512

    28a9767ee3ad3f260bafd4bd6cd30db3908fa63e6049df5b99e50f6cd5ec68d168a3cfa238fceba5e59626ea95b809cf0edebc5baa427ce1fcd989af8c958c52

  • SSDEEP

    12288:LcR/C44VLG/8zwfVHQ8/teJhIDu8mHI8NMgzHQo:Lm/P4RG/8ziwGeJhC9S

Malware Config

Extracted

Family

xtremerat

C2

tr3x.tzo.cc

Signatures

  • Detect XtremeRAT payload 8 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\575be827aaf815b042eeb2f26256aa36_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\575be827aaf815b042eeb2f26256aa36_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Users\Admin\AppData\Local\Temp\575be827aaf815b042eeb2f26256aa36_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\575be827aaf815b042eeb2f26256aa36_JaffaCakes118.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1968
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        PID:2444
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:2060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\InstallDir\tr3x.exe

    Filesize

    636KB

    MD5

    575be827aaf815b042eeb2f26256aa36

    SHA1

    0fbaac8c23c753087600ebb60d88156c0e879cf4

    SHA256

    7482550afd104fb717817aa4a366e6f5c91377b1add23dd3ee4986b6283589c7

    SHA512

    28a9767ee3ad3f260bafd4bd6cd30db3908fa63e6049df5b99e50f6cd5ec68d168a3cfa238fceba5e59626ea95b809cf0edebc5baa427ce1fcd989af8c958c52

  • memory/1968-2-0x0000000013140000-0x000000001315C000-memory.dmp

    Filesize

    112KB

  • memory/1968-4-0x0000000013140000-0x000000001315C000-memory.dmp

    Filesize

    112KB

  • memory/1968-3-0x0000000013140000-0x000000001315C000-memory.dmp

    Filesize

    112KB

  • memory/1968-5-0x0000000013140000-0x000000001315C000-memory.dmp

    Filesize

    112KB

  • memory/1968-16-0x0000000013140000-0x000000001315C000-memory.dmp

    Filesize

    112KB

  • memory/2060-15-0x0000000013140000-0x000000001315C000-memory.dmp

    Filesize

    112KB

  • memory/2060-18-0x0000000013140000-0x000000001315C000-memory.dmp

    Filesize

    112KB

  • memory/2444-11-0x0000000013140000-0x000000001315C000-memory.dmp

    Filesize

    112KB

  • memory/2444-10-0x0000000013140000-0x000000001315C000-memory.dmp

    Filesize

    112KB