Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 13:42
Static task
static1
Behavioral task
behavioral1
Sample
5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe
-
Size
575KB
-
MD5
5c2ea8e05e35b9017b7875fff439d038
-
SHA1
5561cabea7c88e802ee1d670105ac99160143e96
-
SHA256
d3daa693ce522363d33f84a5c731b5feba4e1002ed97aebae63d4fea99ae4141
-
SHA512
d0ffaf22980871a01f80d333dc50b5bd354730febdd199de1f7341c6b1043d59e4f63bdcd63e15da7f812060bcb2a0b165829095e5f1bab0a89e778c9d483916
-
SSDEEP
12288:VnGYSHKndNmi+LIAS/kmqogbfW1pf5PxZZWm6HyR5MCgK:ttdNL+LIAOkbhurUNSR5MCv
Malware Config
Extracted
xtremerat
seko1230.dyndns.org
Signatures
-
Detect XtremeRAT payload 8 IoCs
resource yara_rule behavioral1/memory/2932-9-0x0000000010000000-0x00000000100DB000-memory.dmp family_xtremerat behavioral1/memory/2932-10-0x0000000010000000-0x00000000100DB000-memory.dmp family_xtremerat behavioral1/memory/2932-8-0x0000000010001000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2840-16-0x0000000010000000-0x00000000100DB000-memory.dmp family_xtremerat behavioral1/memory/2932-17-0x0000000010000000-0x00000000100DB000-memory.dmp family_xtremerat behavioral1/memory/2932-19-0x0000000010000000-0x00000000100DB000-memory.dmp family_xtremerat behavioral1/memory/2932-22-0x0000000010001000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2840-23-0x0000000010000000-0x00000000100DB000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{76U5DODE-502C-520Q-N37T-HXDS8J661KJH} 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{76U5DODE-502C-520Q-N37T-HXDS8J661KJH}\StubPath = "C:\\Windows\\Installer\\svchost.exe restart" 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{76U5DODE-502C-520Q-N37T-HXDS8J661KJH} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{76U5DODE-502C-520Q-N37T-HXDS8J661KJH}\StubPath = "C:\\Windows\\Installer\\svchost.exe" svchost.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2932-1-0x00000000002D0000-0x00000000002E1000-memory.dmp upx behavioral1/memory/2932-3-0x00000000002D0000-0x00000000002E1000-memory.dmp upx behavioral1/memory/2932-4-0x00000000002D0000-0x00000000002E1000-memory.dmp upx behavioral1/memory/2932-2-0x00000000002D0000-0x00000000002E1000-memory.dmp upx behavioral1/memory/2932-5-0x00000000002D0000-0x00000000002E1000-memory.dmp upx behavioral1/memory/2932-6-0x00000000002F0000-0x0000000000328000-memory.dmp upx behavioral1/memory/2932-7-0x00000000002F0000-0x0000000000328000-memory.dmp upx behavioral1/memory/2932-20-0x00000000002D0000-0x00000000002E1000-memory.dmp upx behavioral1/memory/2932-21-0x00000000002F0000-0x0000000000328000-memory.dmp upx -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\Installer\\svchost.exe" 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\Installer\\svchost.exe" 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "%updates%" 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\Installer\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\Installer\\svchost.exe" svchost.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Installer\svchost.exe 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe File created C:\Windows\Installer\svchost.exe 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe File opened for modification C:\Windows\Installer\ 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2932 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2840 2932 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe 30 PID 2932 wrote to memory of 2840 2932 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe 30 PID 2932 wrote to memory of 2840 2932 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe 30 PID 2932 wrote to memory of 2840 2932 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe 30 PID 2932 wrote to memory of 2840 2932 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
PID:2840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
575KB
MD55c2ea8e05e35b9017b7875fff439d038
SHA15561cabea7c88e802ee1d670105ac99160143e96
SHA256d3daa693ce522363d33f84a5c731b5feba4e1002ed97aebae63d4fea99ae4141
SHA512d0ffaf22980871a01f80d333dc50b5bd354730febdd199de1f7341c6b1043d59e4f63bdcd63e15da7f812060bcb2a0b165829095e5f1bab0a89e778c9d483916