Analysis
-
max time kernel
149s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 09:04
Behavioral task
behavioral1
Sample
5b46ce7abd60b3d91014aaf3072e020a_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5b46ce7abd60b3d91014aaf3072e020a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5b46ce7abd60b3d91014aaf3072e020a_JaffaCakes118.exe
-
Size
33KB
-
MD5
5b46ce7abd60b3d91014aaf3072e020a
-
SHA1
cc7929d5fd987fac78fa0645f3dfd574084b8df5
-
SHA256
b982437ecf190e7babec6a1d2b687898a86877f63e2d7011b21df94b11364575
-
SHA512
c84d78c00c7d3522d6f06aaad2e54bba539f89383e6ac996c75c5a9ee632f8e99ae03d2708957bd6ff0b5d90703be5792e4d550d7c38ad2855430b0a638c1dfc
-
SSDEEP
768:5MuijtHf5g7/IIG3bGcYDBSvFIWuePQtv66lmtzDR9uKpd0tj:yNW71rcYDAWeotvXlMLS
Malware Config
Extracted
xtremerat
kasap55.no-ip.biz
Signatures
-
Detect XtremeRAT payload 3 IoCs
resource yara_rule behavioral1/memory/2404-3-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/2028-5-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/2404-6-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
resource yara_rule behavioral1/memory/2028-0-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2404-3-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2028-5-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2404-6-0x0000000010000000-0x000000001004D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2404 2028 5b46ce7abd60b3d91014aaf3072e020a_JaffaCakes118.exe 29 PID 2028 wrote to memory of 2404 2028 5b46ce7abd60b3d91014aaf3072e020a_JaffaCakes118.exe 29 PID 2028 wrote to memory of 2404 2028 5b46ce7abd60b3d91014aaf3072e020a_JaffaCakes118.exe 29 PID 2028 wrote to memory of 2404 2028 5b46ce7abd60b3d91014aaf3072e020a_JaffaCakes118.exe 29 PID 2028 wrote to memory of 2404 2028 5b46ce7abd60b3d91014aaf3072e020a_JaffaCakes118.exe 29 PID 2028 wrote to memory of 2484 2028 5b46ce7abd60b3d91014aaf3072e020a_JaffaCakes118.exe 30 PID 2028 wrote to memory of 2484 2028 5b46ce7abd60b3d91014aaf3072e020a_JaffaCakes118.exe 30 PID 2028 wrote to memory of 2484 2028 5b46ce7abd60b3d91014aaf3072e020a_JaffaCakes118.exe 30 PID 2028 wrote to memory of 2484 2028 5b46ce7abd60b3d91014aaf3072e020a_JaffaCakes118.exe 30 PID 2028 wrote to memory of 2484 2028 5b46ce7abd60b3d91014aaf3072e020a_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b46ce7abd60b3d91014aaf3072e020a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5b46ce7abd60b3d91014aaf3072e020a_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:2404
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:2484
-