Analysis
-
max time kernel
93s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2024 13:07
Static task
static1
Behavioral task
behavioral1
Sample
5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe
-
Size
194KB
-
MD5
5c11380aabc72b9c1c2885f723d4408e
-
SHA1
3d412a39e58de80d839486de8f2a6b07d7549455
-
SHA256
e7503289af08cfafc81b9c5e21f64d6339c7603db79ccb239ae64ab540649e34
-
SHA512
95d36e5d0955e1b676ec76d7ba4eeaa9363ae76666fae727288d924bccbe51ba05c3d280f2ae86bc546fa698e6f073a160f28d033358e9a289fcc94160b0c9cd
-
SSDEEP
6144:OZ6QpU0j56Mu5pYM8aiDBuJcqbWbS+ZKnJr:2pU9b5pYXaiDqMKJr
Malware Config
Signatures
-
Detect XtremeRAT payload 1 IoCs
resource yara_rule behavioral2/memory/2756-7-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Executes dropped EXE 1 IoCs
pid Process 2756 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HostProcess = "C:\\Users\\Admin\\AppData\\Roaming\\HostProcess\\5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe" 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2608 set thread context of 2756 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 85 -
Program crash 1 IoCs
pid pid_target Process procid_target 4588 2756 WerFault.exe 85 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2608 wrote to memory of 2756 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 85 PID 2608 wrote to memory of 2756 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 85 PID 2608 wrote to memory of 2756 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 85 PID 2608 wrote to memory of 2756 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 85 PID 2608 wrote to memory of 2756 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 85 PID 2608 wrote to memory of 2756 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 85 PID 2608 wrote to memory of 2756 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 85 PID 2608 wrote to memory of 2756 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 85 PID 2608 wrote to memory of 2756 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 85 PID 2608 wrote to memory of 2756 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 85 PID 2608 wrote to memory of 2756 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 85 PID 2608 wrote to memory of 2756 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 85 PID 2608 wrote to memory of 2756 2608 5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5c11380aabc72b9c1c2885f723d4408e_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\vbc.exeC:\Users\Admin\AppData\Local\Temp\vbc.exe2⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 123⤵
- Program crash
PID:4588
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2756 -ip 27561⤵PID:3116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34