Analysis

  • max time kernel
    147s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18-07-2024 12:32

General

  • Target

    576451579cdafea43c2061ab41728187_JaffaCakes118.exe

  • Size

    643KB

  • MD5

    576451579cdafea43c2061ab41728187

  • SHA1

    8281dbb47ec31366faeb878ec26ad8cc056a06d2

  • SHA256

    602ae1b840761cda082940ead7a025aa9e2d28d570d86d9cdfaf79e5ea466544

  • SHA512

    86824fd32a290162060bc2785abf890fa94655b645f803cf620a2a65332a17741dbc65209a866926000cedf68f800cafdd321ad487cf9e57d19c6ba4053a0341

  • SSDEEP

    12288:LX8N4mHr8vKfE5V0VQwQB7sOQ3AFYGq6gJLZH2USEIsWF7gcBcoFnDQ:uL8bn17sOQ3UYygJ8USQWF752

Malware Config

Signatures

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\576451579cdafea43c2061ab41728187_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\576451579cdafea43c2061ab41728187_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Users\Admin\AppData\Local\Xenocode\Sandbox\Project1\1.00\1432.12.24T23.29\Virtual\STUBEXE\@APPDATALOCAL@\Temp\seri7.exe
      "C:\Users\Admin\AppData\Local\Temp\seri7.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Users\Admin\AppData\Local\Xenocode\Sandbox\Project1\1.00\1432.12.24T23.29\Virtual\STUBEXE\@APPDATALOCAL@\Temp\seri7.exe
        "C:\Users\Admin\AppData\Local\Temp\seri7.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3068
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          PID:2948
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
            PID:2760
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:2524
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              4⤵
                PID:2836
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe"
                4⤵
                  PID:2844
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe"
                  4⤵
                    PID:2556
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe"
                    4⤵
                      PID:2804
                    • C:\Program Files\Internet Explorer\iexplore.exe
                      "C:\Program Files\Internet Explorer\iexplore.exe"
                      4⤵
                        PID:1732
                      • C:\Program Files\Internet Explorer\iexplore.exe
                        "C:\Program Files\Internet Explorer\iexplore.exe"
                        4⤵
                          PID:2204

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • \Users\Admin\AppData\Local\Xenocode\Sandbox\Project1\1.00\1432.12.24T23.29\Virtual\STUBEXE\@APPDATALOCAL@\Temp\seri7.exe

                    Filesize

                    17KB

                    MD5

                    91b04c9117ab49ef8f8cf4150bec9f1d

                    SHA1

                    c919eed86b9c692441c516cf130d2fd97bde505b

                    SHA256

                    dc7eef8ef6640cfcafdc3aa0b7a2b3b86b6952b018e405f0efe89aea400af446

                    SHA512

                    db11be15ac6662cf89c1f0aed7ddee2f2c2ad2f261d2bb57dc7fe21fba5746158215a8d42e4b03b43e0c8d6fb7fd59568a8ff48a63c064a7bcbc433aa3540373

                  • memory/2072-7-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-5-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-3-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-1-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-0-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-9-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-11-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-31-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-29-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-27-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-25-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-23-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-21-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-19-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-17-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-15-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-13-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-33-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-35-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-63-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-61-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-59-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-57-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-55-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-53-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-51-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-49-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-47-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-45-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-43-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-41-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-39-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-37-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-205-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-259-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-307-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-306-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-305-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-304-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-293-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-282-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-273-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-243-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-218-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-191-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-623-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB

                  • memory/2072-185-0x00000000776A0000-0x00000000776A1000-memory.dmp

                    Filesize

                    4KB

                  • memory/2072-151-0x00000000776A0000-0x00000000776A1000-memory.dmp

                    Filesize

                    4KB

                  • memory/2072-150-0x0000000000370000-0x00000000003DC000-memory.dmp

                    Filesize

                    432KB