Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 18:41
Static task
static1
Behavioral task
behavioral1
Sample
5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe
-
Size
223KB
-
MD5
5d2f51d7a619a26c865981aa1fe86f1e
-
SHA1
1f8e9e735993a6df36568d87e6da22cb25fe290a
-
SHA256
dc67eef2da5bb719fa5c9f8de8e37fe3c4353e9e358e0840212af0b33508bd83
-
SHA512
aad289059901c917dfe9f77cf7556506c52e926b12db30cc3b46f4b800dac4111085b883dc7d0ed2489cdfcb73c21f61c68846391f4ed4abbfbed680f29a3885
-
SSDEEP
3072:s45PGh3ROI/JBTWh0SBT9uOUD/2NfTJK5:FGh3YsBed9g8TJ
Malware Config
Signatures
-
Detect XtremeRAT payload 6 IoCs
resource yara_rule behavioral1/memory/2796-8-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2796-7-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2796-12-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2796-6-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2796-5-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2796-9-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Startup Key = "C:\\Users\\Admin\\AppData\\Local\\Temp\\name.exe" 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2732 set thread context of 2796 2732 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 30 -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2796 2732 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2796 2732 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2796 2732 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2796 2732 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2796 2732 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2796 2732 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2796 2732 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2796 2732 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2796 2732 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2796 2732 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2796 2732 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2796 2732 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵PID:2796
-