Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2024 13:42
Static task
static1
Behavioral task
behavioral1
Sample
5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe
-
Size
575KB
-
MD5
5c2ea8e05e35b9017b7875fff439d038
-
SHA1
5561cabea7c88e802ee1d670105ac99160143e96
-
SHA256
d3daa693ce522363d33f84a5c731b5feba4e1002ed97aebae63d4fea99ae4141
-
SHA512
d0ffaf22980871a01f80d333dc50b5bd354730febdd199de1f7341c6b1043d59e4f63bdcd63e15da7f812060bcb2a0b165829095e5f1bab0a89e778c9d483916
-
SSDEEP
12288:VnGYSHKndNmi+LIAS/kmqogbfW1pf5PxZZWm6HyR5MCgK:ttdNL+LIAOkbhurUNSR5MCv
Malware Config
Extracted
xtremerat
seko1230.dyndns.org
Signatures
-
Detect XtremeRAT payload 3 IoCs
resource yara_rule behavioral2/memory/2516-17-0x0000000010000000-0x00000000100DB000-memory.dmp family_xtremerat behavioral2/memory/2516-24-0x0000000010000000-0x00000000100DB000-memory.dmp family_xtremerat behavioral2/memory/3356-27-0x0000000010000000-0x00000000100DB000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{76U5DODE-502C-520Q-N37T-HXDS8J661KJH} 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76U5DODE-502C-520Q-N37T-HXDS8J661KJH}\StubPath = "C:\\Windows\\Installer\\svchost.exe restart" 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/3356-3-0x0000000000740000-0x0000000000751000-memory.dmp upx behavioral2/memory/3356-4-0x0000000000740000-0x0000000000751000-memory.dmp upx behavioral2/memory/3356-2-0x0000000000740000-0x0000000000751000-memory.dmp upx behavioral2/memory/3356-1-0x0000000000740000-0x0000000000751000-memory.dmp upx behavioral2/memory/3356-5-0x0000000000740000-0x0000000000751000-memory.dmp upx behavioral2/memory/3356-6-0x00000000024F0000-0x0000000002528000-memory.dmp upx behavioral2/memory/3356-7-0x00000000024F0000-0x0000000002528000-memory.dmp upx behavioral2/memory/3356-28-0x0000000000740000-0x0000000000751000-memory.dmp upx behavioral2/memory/3356-29-0x00000000024F0000-0x0000000002528000-memory.dmp upx -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\Installer\\svchost.exe" 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\Installer\\svchost.exe" 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "%updates%" 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Installer\svchost.exe 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe File created C:\Windows\Installer\svchost.exe 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe File opened for modification C:\Windows\Installer\ 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4532 2516 WerFault.exe 87 1776 2516 WerFault.exe 87 -
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3356 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3356 wrote to memory of 2516 3356 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe 87 PID 3356 wrote to memory of 2516 3356 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe 87 PID 3356 wrote to memory of 2516 3356 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe 87 PID 3356 wrote to memory of 2516 3356 5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5c2ea8e05e35b9017b7875fff439d038_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:2516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 4803⤵
- Program crash
PID:4532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 5003⤵
- Program crash
PID:1776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2516 -ip 25161⤵PID:3932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2516 -ip 25161⤵PID:4384