Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2024 01:23
Static task
static1
Behavioral task
behavioral1
Sample
5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe
-
Size
193KB
-
MD5
5e7e2e2f2e9df8a26f0f8751dd5908b3
-
SHA1
8d3816d1752f82a20f2d24a3c3a69cc0219dc553
-
SHA256
8d10a8991010710c96fd1b7e914fcb6d64c67349e94c911eb790fdb74a59e062
-
SHA512
fafc24aa12a4ffbbd4654269c33ee8522902c5da025fdad5bb0f92e0ab5a3ed6d09d920b8345ca529b9306f319414722ef86b3ca81f64ae6dc33ed83f5f7a4d3
-
SSDEEP
3072:nvo4BKRd+XQeKDCSz5BjPnvFsZu5Oqrts2R6btAzTpTgZEADOB:nv1BxXeGugqi2Qyzty
Malware Config
Extracted
xtremerat
hami7.no-ip.org
Signatures
-
Detect XtremeRAT payload 5 IoCs
resource yara_rule behavioral2/memory/1836-9-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/1836-10-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/2240-12-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/1836-13-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/2240-14-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
resource yara_rule behavioral2/memory/1836-5-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral2/memory/1836-8-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral2/memory/1836-9-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral2/memory/1836-10-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral2/memory/2240-12-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral2/memory/1836-13-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral2/memory/2240-14-0x0000000010000000-0x0000000010048000-memory.dmp upx -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4552 set thread context of 1836 4552 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 92 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe File created C:\Windows\assembly\Desktop.ini 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2352 2240 WerFault.exe 93 2476 2240 WerFault.exe 93 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4552 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4552 wrote to memory of 1836 4552 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 92 PID 4552 wrote to memory of 1836 4552 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 92 PID 4552 wrote to memory of 1836 4552 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 92 PID 4552 wrote to memory of 1836 4552 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 92 PID 4552 wrote to memory of 1836 4552 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 92 PID 4552 wrote to memory of 1836 4552 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 92 PID 4552 wrote to memory of 1836 4552 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 92 PID 4552 wrote to memory of 1836 4552 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 92 PID 1836 wrote to memory of 2240 1836 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 93 PID 1836 wrote to memory of 2240 1836 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 93 PID 1836 wrote to memory of 2240 1836 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 93 PID 1836 wrote to memory of 2240 1836 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 93 PID 1836 wrote to memory of 4380 1836 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 94 PID 1836 wrote to memory of 4380 1836 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 94 PID 1836 wrote to memory of 4380 1836 5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5e7e2e2f2e9df8a26f0f8751dd5908b3_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:2240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 4804⤵
- Program crash
PID:2352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 5044⤵
- Program crash
PID:2476
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:4380
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2240 -ip 22401⤵PID:2056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2240 -ip 22401⤵PID:3812