Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    19-07-2024 20:44

General

  • Target

    5d97f256c1d8584001991b794bd2c3ea_JaffaCakes118.exe

  • Size

    86KB

  • MD5

    5d97f256c1d8584001991b794bd2c3ea

  • SHA1

    f00ecc7bf06f3c045a472c6a9adcdd2c0c78900b

  • SHA256

    cd037732ed2cb703b893532714351df1d0f495ff0adbcd8a1a98d72114a98c53

  • SHA512

    98a269562465b69d21fd327e4a39cd6fe76af079e70a648e384efa01b6bea2c833777b1681146b1fe6f1f216dbced9d9cf3278eeac57880b821530c98a59cc35

  • SSDEEP

    1536:bLL7WmOwpujCEDCNrnD77Tv0eD1taRcKJe3sE:bLL7WmdujrCNTRqJe3sE

Malware Config

Extracted

Family

xtremerat

C2

sucucha.no-ip.biz

Signatures

  • Detect XtremeRAT payload 4 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d97f256c1d8584001991b794bd2c3ea_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5d97f256c1d8584001991b794bd2c3ea_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2576
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3064
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:2912
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:2296
        • C:\Users\Admin\AppData\Local\Temp\Sever_Creado.exe
          "C:\Users\Admin\AppData\Local\Temp\Sever_Creado.exe"
          2⤵
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2708

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Users\Admin\AppData\Local\Temp\Sever_Creado.exe

        Filesize

        24KB

        MD5

        f1c4308833a275cd4584a03928868f0f

        SHA1

        7d988a301fa336d52d215511ba6a9bf13d17770f

        SHA256

        e33e7b74b832ee49efb705824c5090c41833ba85c28f76ab33b815451fbb55b2

        SHA512

        b391b2ca2b1a7bbc9e284d9c586426e8394a93ed9f63facfc451324caa81878b493ed9d01bfe967b8e2712669a41352073bf59861cf6a557d3f532a928e4d25a

      • \Users\Admin\AppData\Local\Temp\server.exe

        Filesize

        33KB

        MD5

        57d785d83fafb9dd41b0b7da978781a9

        SHA1

        6b4a6864cf2c24097df3748c1ac0fbf1eb4c2d6c

        SHA256

        55ff4c1eab4dd284c9b08fb5d311f10a66bd3856c22f67ea036c08d885bfefbc

        SHA512

        f8deba7b85e4bfff073d406fdcb7484ddf1f236e0b4884a369d8942dd8ecba3a8949a126e2c4f97c1f803f55537674596afcb863712f6d293e9f084bdaadf5b2

      • memory/2576-13-0x0000000010000000-0x000000001004D000-memory.dmp

        Filesize

        308KB

      • memory/2576-2-0x0000000074220000-0x00000000747CB000-memory.dmp

        Filesize

        5.7MB

      • memory/2576-14-0x0000000010000000-0x000000001004D000-memory.dmp

        Filesize

        308KB

      • memory/2576-0-0x0000000074221000-0x0000000074222000-memory.dmp

        Filesize

        4KB

      • memory/2576-1-0x0000000074220000-0x00000000747CB000-memory.dmp

        Filesize

        5.7MB

      • memory/2576-31-0x0000000074220000-0x00000000747CB000-memory.dmp

        Filesize

        5.7MB

      • memory/2912-18-0x0000000010000000-0x000000001004D000-memory.dmp

        Filesize

        308KB

      • memory/2912-16-0x0000000010000000-0x000000001004D000-memory.dmp

        Filesize

        308KB

      • memory/2912-32-0x0000000010000000-0x000000001004D000-memory.dmp

        Filesize

        308KB

      • memory/3064-15-0x0000000010000000-0x000000001004D000-memory.dmp

        Filesize

        308KB

      • memory/3064-19-0x0000000010000000-0x000000001004D000-memory.dmp

        Filesize

        308KB