Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 13:07
Static task
static1
Behavioral task
behavioral1
Sample
5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe
-
Size
194KB
-
MD5
5c11380aabc72b9c1c2885f723d4408e
-
SHA1
3d412a39e58de80d839486de8f2a6b07d7549455
-
SHA256
e7503289af08cfafc81b9c5e21f64d6339c7603db79ccb239ae64ab540649e34
-
SHA512
95d36e5d0955e1b676ec76d7ba4eeaa9363ae76666fae727288d924bccbe51ba05c3d280f2ae86bc546fa698e6f073a160f28d033358e9a289fcc94160b0c9cd
-
SSDEEP
6144:OZ6QpU0j56Mu5pYM8aiDBuJcqbWbS+ZKnJr:2pU9b5pYXaiDqMKJr
Malware Config
Signatures
-
Detect XtremeRAT payload 6 IoCs
resource yara_rule behavioral1/memory/2524-11-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2524-18-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2524-15-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2524-14-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2524-13-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2524-12-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Executes dropped EXE 1 IoCs
pid Process 2524 vbc.exe -
Loads dropped DLL 1 IoCs
pid Process 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\HostProcess = "C:\\Users\\Admin\\AppData\\Roaming\\HostProcess\\5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe" 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2568 set thread context of 2524 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 30 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2524 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2524 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2524 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2524 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2524 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2524 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2524 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2524 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2524 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2524 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2524 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2524 2568 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\vbc.exeC:\Users\Admin\AppData\Local\Temp\vbc.exe2⤵
- Executes dropped EXE
PID:2524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98