Analysis

  • max time kernel
    136s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-07-2024 20:04

General

  • Target

    5d789f67a2a4eb67b74952cf4310ecb2_JaffaCakes118.exe

  • Size

    237KB

  • MD5

    5d789f67a2a4eb67b74952cf4310ecb2

  • SHA1

    94c4e4f177cf86c879e4b9a179a9b19481e42a5b

  • SHA256

    033575dfed11b3aad494bec5d1041b1076cdc75f6ab61407ecd2fa503c7f965a

  • SHA512

    91e7fa12825a3559dbd4c96fa8261c29a5868d2279f007f9b3579e8a3b4bb71362fce7e213719e453b6718ef5fde7179e8ec98c115080f755d8f03bd042253bc

  • SSDEEP

    6144:hOj6JqRe+3lnVW5GJZ2tNYLj8MfsrXRAD++wc1q4qqvqLO7:hKYqRr3NVzYKj86s2ScsQqLO7

Malware Config

Extracted

Family

xtremerat

C2

wach.no-ip.biz

Signatures

  • Detect XtremeRAT payload 4 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d789f67a2a4eb67b74952cf4310ecb2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5d789f67a2a4eb67b74952cf4310ecb2_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Users\Admin\AppData\Local\Temp\5d789f67a2a4eb67b74952cf4310ecb2_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\5d789f67a2a4eb67b74952cf4310ecb2_JaffaCakes118.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:872
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:1800
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 480
            4⤵
            • Program crash
            PID:2684
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 488
            4⤵
            • Program crash
            PID:3488
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          3⤵
            PID:2812
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1800 -ip 1800
        1⤵
          PID:4804
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1800 -ip 1800
          1⤵
            PID:4344

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/872-45-0x0000000010000000-0x0000000010048000-memory.dmp

            Filesize

            288KB

          • memory/872-46-0x0000000010000000-0x0000000010048000-memory.dmp

            Filesize

            288KB

          • memory/1800-50-0x0000000010000000-0x0000000010048000-memory.dmp

            Filesize

            288KB

          • memory/1800-49-0x0000000010000000-0x0000000010048000-memory.dmp

            Filesize

            288KB

          • memory/2256-41-0x0000000002D80000-0x0000000002D81000-memory.dmp

            Filesize

            4KB

          • memory/2256-9-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

            Filesize

            4KB

          • memory/2256-10-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

            Filesize

            4KB

          • memory/2256-40-0x0000000002D50000-0x0000000002D51000-memory.dmp

            Filesize

            4KB

          • memory/2256-8-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

            Filesize

            4KB

          • memory/2256-7-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

            Filesize

            4KB

          • memory/2256-21-0x0000000002300000-0x0000000002301000-memory.dmp

            Filesize

            4KB

          • memory/2256-20-0x0000000002230000-0x0000000002240000-memory.dmp

            Filesize

            64KB

          • memory/2256-19-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

            Filesize

            4KB

          • memory/2256-18-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

            Filesize

            4KB

          • memory/2256-0-0x0000000000400000-0x00000000004B6000-memory.dmp

            Filesize

            728KB

          • memory/2256-16-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

            Filesize

            4KB

          • memory/2256-39-0x0000000002D60000-0x0000000002D61000-memory.dmp

            Filesize

            4KB

          • memory/2256-5-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

            Filesize

            4KB

          • memory/2256-4-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

            Filesize

            4KB

          • memory/2256-3-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

            Filesize

            4KB

          • memory/2256-2-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

            Filesize

            4KB

          • memory/2256-44-0x0000000002D90000-0x0000000002D91000-memory.dmp

            Filesize

            4KB

          • memory/2256-43-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

            Filesize

            4KB

          • memory/2256-42-0x0000000002D70000-0x0000000002D71000-memory.dmp

            Filesize

            4KB

          • memory/2256-17-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

            Filesize

            4KB

          • memory/2256-11-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

            Filesize

            4KB

          • memory/2256-6-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

            Filesize

            4KB

          • memory/2256-38-0x0000000002D30000-0x0000000002D31000-memory.dmp

            Filesize

            4KB

          • memory/2256-37-0x0000000002D40000-0x0000000002D41000-memory.dmp

            Filesize

            4KB

          • memory/2256-36-0x0000000002D10000-0x0000000002D11000-memory.dmp

            Filesize

            4KB

          • memory/2256-35-0x0000000002D20000-0x0000000002D21000-memory.dmp

            Filesize

            4KB

          • memory/2256-34-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

            Filesize

            4KB

          • memory/2256-33-0x0000000002D00000-0x0000000002D01000-memory.dmp

            Filesize

            4KB

          • memory/2256-32-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

            Filesize

            4KB

          • memory/2256-31-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

            Filesize

            4KB

          • memory/2256-30-0x00000000022A0000-0x00000000022A1000-memory.dmp

            Filesize

            4KB

          • memory/2256-29-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

            Filesize

            4KB

          • memory/2256-28-0x0000000002280000-0x0000000002281000-memory.dmp

            Filesize

            4KB

          • memory/2256-27-0x0000000002290000-0x0000000002291000-memory.dmp

            Filesize

            4KB

          • memory/2256-26-0x0000000002330000-0x0000000002331000-memory.dmp

            Filesize

            4KB

          • memory/2256-25-0x0000000002220000-0x0000000002221000-memory.dmp

            Filesize

            4KB

          • memory/2256-24-0x0000000002210000-0x0000000002211000-memory.dmp

            Filesize

            4KB

          • memory/2256-23-0x0000000002320000-0x0000000002321000-memory.dmp

            Filesize

            4KB

          • memory/2256-12-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

            Filesize

            4KB

          • memory/2256-13-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

            Filesize

            4KB

          • memory/2256-48-0x0000000000400000-0x00000000004B6000-memory.dmp

            Filesize

            728KB

          • memory/2256-14-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

            Filesize

            4KB

          • memory/2256-1-0x0000000002310000-0x000000000231A000-memory.dmp

            Filesize

            40KB