Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
21-10-2024 00:01
General
-
Target
64c0c5260f59f5139120feaf9e547f69_JaffaCakes118.exe
-
Size
41KB
-
MD5
64c0c5260f59f5139120feaf9e547f69
-
SHA1
9d98d6868b7aedad0e98f2ad06cc0583b9e8300b
-
SHA256
22873ebeed83bea0d9a53d6f82b0747eea9588fbbe4ba9f5b57fa33124398ba6
-
SHA512
e37f825d980cee2ad4de43e1a829d17dfb8d7bfb697f832673d29f94046b0e925c8e3a37b6f4f9ce50fcfddda8ac701078a7971e324a6b616bb288ec613ccedc
-
SSDEEP
768:+YBwkX1OuEl1wET2e78mfV5C9PDe7YpKIqbANXmqFnrw0Md4eaOxYIPAujivLiiI:Rtc1wETnomN5CRecvrmqy0Miey4A2iX0
Malware Config
Extracted
xtremerat
qinfeng.dyndns.org
hw19820211.3322.org
ໄqinfengde.no-ip.org
Signatures
-
Detect XtremeRAT payload 2 IoCs
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\64c0c5260f59f5139120feaf9e547f69_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\64c0c5260f59f5139120feaf9e547f69_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
352KB
-
Filesize
352KB
-
Filesize
352KB
-
Filesize
352KB