Analysis
-
max time kernel
148s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 19:13
Static task
static1
Behavioral task
behavioral1
Sample
5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe
-
Size
227KB
-
MD5
5d4a74baedaf1de6584d15a2c80fa3ee
-
SHA1
9ce1c7cd2bff9972009979ca8b2001991bc836bb
-
SHA256
b8640645abeba0210c7bb760d5241cec41c188580c8e9274f5a57e982dd9ac47
-
SHA512
2d30930cd749bf2886fee6cf745926d516ec6967d5044d88ea0f2d550277a41ccf61fad711ed25b447820dd2c4d4241213e4d658326e35bab5fabe54d1df0987
-
SSDEEP
6144:iYZeOcuVD+g4fX28azwn22PF+ympFb0Jj4zrdh5:veOJV6ggm88w2o/mpZ0eN
Malware Config
Extracted
xtremerat
biladi2000.no-ip.info
Signatures
-
Detect XtremeRAT payload 2 IoCs
resource yara_rule behavioral1/memory/2528-12-0x0000000000C80000-0x0000000000CA2000-memory.dmp family_xtremerat behavioral1/memory/1692-16-0x0000000000C80000-0x0000000000CA2000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8} 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\InstallDir\Server.exe 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallDir\Server.exe 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1692 wrote to memory of 2528 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 30 PID 1692 wrote to memory of 2528 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 30 PID 1692 wrote to memory of 2528 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 30 PID 1692 wrote to memory of 2528 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 30 PID 1692 wrote to memory of 2528 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 30 PID 1692 wrote to memory of 2628 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 31 PID 1692 wrote to memory of 2628 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 31 PID 1692 wrote to memory of 2628 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 31 PID 1692 wrote to memory of 2628 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 31 PID 1692 wrote to memory of 2696 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 32 PID 1692 wrote to memory of 2696 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 32 PID 1692 wrote to memory of 2696 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 32 PID 1692 wrote to memory of 2696 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 32 PID 1692 wrote to memory of 2572 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 33 PID 1692 wrote to memory of 2572 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 33 PID 1692 wrote to memory of 2572 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 33 PID 1692 wrote to memory of 2572 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 33 PID 1692 wrote to memory of 2684 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 34 PID 1692 wrote to memory of 2684 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 34 PID 1692 wrote to memory of 2684 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 34 PID 1692 wrote to memory of 2684 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 34 PID 1692 wrote to memory of 2660 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 35 PID 1692 wrote to memory of 2660 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 35 PID 1692 wrote to memory of 2660 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 35 PID 1692 wrote to memory of 2660 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 35 PID 1692 wrote to memory of 2700 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 36 PID 1692 wrote to memory of 2700 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 36 PID 1692 wrote to memory of 2700 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 36 PID 1692 wrote to memory of 2700 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 36 PID 1692 wrote to memory of 2056 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 37 PID 1692 wrote to memory of 2056 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 37 PID 1692 wrote to memory of 2056 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 37 PID 1692 wrote to memory of 2056 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 37 PID 1692 wrote to memory of 2456 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 38 PID 1692 wrote to memory of 2456 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 38 PID 1692 wrote to memory of 2456 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 38 PID 1692 wrote to memory of 2456 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 38 PID 1692 wrote to memory of 2764 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 39 PID 1692 wrote to memory of 2764 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 39 PID 1692 wrote to memory of 2764 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 39 PID 1692 wrote to memory of 2764 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 39 PID 1692 wrote to memory of 2448 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 40 PID 1692 wrote to memory of 2448 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 40 PID 1692 wrote to memory of 2448 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 40 PID 1692 wrote to memory of 2448 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 40 PID 1692 wrote to memory of 2444 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 41 PID 1692 wrote to memory of 2444 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 41 PID 1692 wrote to memory of 2444 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 41 PID 1692 wrote to memory of 2444 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 41 PID 1692 wrote to memory of 2676 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 42 PID 1692 wrote to memory of 2676 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 42 PID 1692 wrote to memory of 2676 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 42 PID 1692 wrote to memory of 2676 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 42 PID 1692 wrote to memory of 2556 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 43 PID 1692 wrote to memory of 2556 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 43 PID 1692 wrote to memory of 2556 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 43 PID 1692 wrote to memory of 2556 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 43 PID 1692 wrote to memory of 2468 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 44 PID 1692 wrote to memory of 2468 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 44 PID 1692 wrote to memory of 2468 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 44 PID 1692 wrote to memory of 2468 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 44 PID 1692 wrote to memory of 2532 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 45 PID 1692 wrote to memory of 2532 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 45 PID 1692 wrote to memory of 2532 1692 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:2528
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2628
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2696
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2572
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2684
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2660
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2700
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2056
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2456
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2764
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2448
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2444
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2676
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2556
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2468
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2532
-