Analysis

  • max time kernel
    112s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-07-2024 20:44

General

  • Target

    5d97f256c1d8584001991b794bd2c3ea_JaffaCakes118.exe

  • Size

    86KB

  • MD5

    5d97f256c1d8584001991b794bd2c3ea

  • SHA1

    f00ecc7bf06f3c045a472c6a9adcdd2c0c78900b

  • SHA256

    cd037732ed2cb703b893532714351df1d0f495ff0adbcd8a1a98d72114a98c53

  • SHA512

    98a269562465b69d21fd327e4a39cd6fe76af079e70a648e384efa01b6bea2c833777b1681146b1fe6f1f216dbced9d9cf3278eeac57880b821530c98a59cc35

  • SSDEEP

    1536:bLL7WmOwpujCEDCNrnD77Tv0eD1taRcKJe3sE:bLL7WmdujrCNTRqJe3sE

Malware Config

Extracted

Family

xtremerat

C2

sucucha.no-ip.biz

Signatures

  • Detect XtremeRAT payload 3 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d97f256c1d8584001991b794bd2c3ea_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5d97f256c1d8584001991b794bd2c3ea_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:220
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:3732
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 484
            4⤵
            • Program crash
            PID:1212
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 504
            4⤵
            • Program crash
            PID:2152
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          3⤵
            PID:5000
        • C:\Users\Admin\AppData\Local\Temp\Sever_Creado.exe
          "C:\Users\Admin\AppData\Local\Temp\Sever_Creado.exe"
          2⤵
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2584
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3732 -ip 3732
        1⤵
          PID:1616
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3732 -ip 3732
          1⤵
            PID:2092

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Sever_Creado.exe

            Filesize

            24KB

            MD5

            f1c4308833a275cd4584a03928868f0f

            SHA1

            7d988a301fa336d52d215511ba6a9bf13d17770f

            SHA256

            e33e7b74b832ee49efb705824c5090c41833ba85c28f76ab33b815451fbb55b2

            SHA512

            b391b2ca2b1a7bbc9e284d9c586426e8394a93ed9f63facfc451324caa81878b493ed9d01bfe967b8e2712669a41352073bf59861cf6a557d3f532a928e4d25a

          • C:\Users\Admin\AppData\Local\Temp\server.exe

            Filesize

            33KB

            MD5

            57d785d83fafb9dd41b0b7da978781a9

            SHA1

            6b4a6864cf2c24097df3748c1ac0fbf1eb4c2d6c

            SHA256

            55ff4c1eab4dd284c9b08fb5d311f10a66bd3856c22f67ea036c08d885bfefbc

            SHA512

            f8deba7b85e4bfff073d406fdcb7484ddf1f236e0b4884a369d8942dd8ecba3a8949a126e2c4f97c1f803f55537674596afcb863712f6d293e9f084bdaadf5b2

          • memory/220-12-0x0000000010000000-0x000000001004D000-memory.dmp

            Filesize

            308KB

          • memory/220-15-0x0000000010000000-0x000000001004D000-memory.dmp

            Filesize

            308KB

          • memory/2236-0-0x00000000747D2000-0x00000000747D3000-memory.dmp

            Filesize

            4KB

          • memory/2236-1-0x00000000747D0000-0x0000000074D81000-memory.dmp

            Filesize

            5.7MB

          • memory/2236-2-0x00000000747D0000-0x0000000074D81000-memory.dmp

            Filesize

            5.7MB

          • memory/2236-30-0x00000000747D0000-0x0000000074D81000-memory.dmp

            Filesize

            5.7MB

          • memory/3732-13-0x0000000010000000-0x000000001004D000-memory.dmp

            Filesize

            308KB

          • memory/3732-16-0x0000000010000000-0x000000001004D000-memory.dmp

            Filesize

            308KB