Analysis

  • max time kernel
    14s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    23-10-2024 14:47

General

  • Target

    6f792bee6b6bb7f17187d7e7050959b4_JaffaCakes118.exe

  • Size

    1.7MB

  • MD5

    6f792bee6b6bb7f17187d7e7050959b4

  • SHA1

    9435583a5ea8992b60a7a5b0b4a54ed7ab145b0e

  • SHA256

    c22ad479f59dae87d2c2b2f25cdb8858eb2574be4defd53a5bd2d588ea80caa9

  • SHA512

    b39d46287b6c5e20ea0975bbcfb2229a4b436612569180eb2fe3e5e43fc04706bdff6ad9620749f19a3e74fe6459f854f8d9fc7f47d14fd2b09573089ef6dc5f

  • SSDEEP

    24576:6ys/iDSL6EMcRDJhe9R6U45vffYz3UPvbwNI0jFYM917cz1y5lEldeViOAoF0RN0:/gL6EMsd523UHb70xh913ceOoF00

Malware Config

Signatures

  • Detect XtremeRAT payload 4 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f792bee6b6bb7f17187d7e7050959b4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6f792bee6b6bb7f17187d7e7050959b4_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:2468
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2868

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2248-0-0x0000000000260000-0x0000000000261000-memory.dmp

      Filesize

      4KB

    • memory/2248-1-0x0000000001DE0000-0x0000000001F4A000-memory.dmp

      Filesize

      1.4MB

    • memory/2248-2-0x0000000010001000-0x0000000010008000-memory.dmp

      Filesize

      28KB

    • memory/2248-3-0x0000000010000000-0x000000001039C000-memory.dmp

      Filesize

      3.6MB

    • memory/2248-4-0x0000000010000000-0x000000001039C000-memory.dmp

      Filesize

      3.6MB

    • memory/2248-9-0x0000000010000000-0x000000001039C000-memory.dmp

      Filesize

      3.6MB

    • memory/2248-14-0x0000000010000000-0x000000001039C000-memory.dmp

      Filesize

      3.6MB

    • memory/2468-5-0x0000000010000000-0x000000001039C000-memory.dmp

      Filesize

      3.6MB

    • memory/2868-16-0x0000000010000000-0x000000001039C000-memory.dmp

      Filesize

      3.6MB