Analysis
-
max time kernel
139s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2024 18:41
Static task
static1
Behavioral task
behavioral1
Sample
5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe
-
Size
223KB
-
MD5
5d2f51d7a619a26c865981aa1fe86f1e
-
SHA1
1f8e9e735993a6df36568d87e6da22cb25fe290a
-
SHA256
dc67eef2da5bb719fa5c9f8de8e37fe3c4353e9e358e0840212af0b33508bd83
-
SHA512
aad289059901c917dfe9f77cf7556506c52e926b12db30cc3b46f4b800dac4111085b883dc7d0ed2489cdfcb73c21f61c68846391f4ed4abbfbed680f29a3885
-
SSDEEP
3072:s45PGh3ROI/JBTWh0SBT9uOUD/2NfTJK5:FGh3YsBed9g8TJ
Malware Config
Signatures
-
Detect XtremeRAT payload 1 IoCs
resource yara_rule behavioral2/memory/1072-4-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup Key = "C:\\Users\\Admin\\AppData\\Local\\Temp\\name.exe" 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5116 set thread context of 1072 5116 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 94 -
Program crash 1 IoCs
pid pid_target Process procid_target 4004 1072 WerFault.exe 94 -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 5116 wrote to memory of 1072 5116 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 94 PID 5116 wrote to memory of 1072 5116 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 94 PID 5116 wrote to memory of 1072 5116 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 94 PID 5116 wrote to memory of 1072 5116 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 94 PID 5116 wrote to memory of 1072 5116 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 94 PID 5116 wrote to memory of 1072 5116 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 94 PID 5116 wrote to memory of 1072 5116 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 94 PID 5116 wrote to memory of 1072 5116 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 94 PID 5116 wrote to memory of 1072 5116 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 94 PID 5116 wrote to memory of 1072 5116 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 94 PID 5116 wrote to memory of 1072 5116 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 94 PID 5116 wrote to memory of 1072 5116 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 94 PID 5116 wrote to memory of 1072 5116 5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d2f51d7a619a26c865981aa1fe86f1e_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵PID:1072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 123⤵
- Program crash
PID:4004
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1072 -ip 10721⤵PID:4492