Analysis

  • max time kernel
    146s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    29-11-2024 10:50

General

  • Target

    b0c2efab0ab3ef4157cd97a2ff8f775e_JaffaCakes118.exe

  • Size

    60KB

  • MD5

    b0c2efab0ab3ef4157cd97a2ff8f775e

  • SHA1

    9bb85026c7a9037e3ae8634a66d3f954ef3f49c3

  • SHA256

    69d873035398746e59c747af9920196bd9fc117ad25196475d64b5a96ff32ce2

  • SHA512

    6d33f4eb4a0ea627fa351a13dff0f1281e916a8084362d9c2e981e284271bf1cca40fd2d1c8ac19ef3db5bb54377bdfe359be0151573220352e14bbcd3f9fb56

  • SSDEEP

    768:l38+6jF/90iYiW1jQU9zKgEFQDqkldnBnibh9fOgKHcIS8YzXBBS8YzXB5zokH6:N3g4v1j1PEFQDqkFibT+UFruFrvoH

Malware Config

Signatures

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Xtremerat family
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 60 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 28 IoCs
  • Loads dropped DLL 29 IoCs
  • Adds Run key to start application 2 TTPs 60 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 59 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0c2efab0ab3ef4157cd97a2ff8f775e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b0c2efab0ab3ef4157cd97a2ff8f775e_JaffaCakes118.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2228
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2708
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2988
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2056
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2600
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1228
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2512
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3064
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1052
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1588
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:568
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1652
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2620
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2364
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2852
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:484
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2200
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1524
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:848
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2332
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2552
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2368
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:1236
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1424
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:1684
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1556
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2180
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2224
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:664
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2296
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:748
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2236
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2380
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2732
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2716
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1716
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2628
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1940
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2752
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2704
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2348
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2416
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:1356
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2100
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:1884
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2460
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2640
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2812
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2060
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1020
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:920
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:572
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:484
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2084
      • C:\Users\Admin\AppData\Roaming\toulse\foul.exe
        "C:\Users\Admin\AppData\Roaming\toulse\foul.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2152
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2320
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MsBiQgMw.cfg

    Filesize

    1KB

    MD5

    05ba495ba8b18b2e9604edc9eeda4879

    SHA1

    360d315bd9af191e22cc3dfbf70a152afad7b1c3

    SHA256

    370391eda0ea002f384f89cc43e1bf9ce0d88b08db7f9f1b85f17a4c1a1fb55b

    SHA512

    bccc4c30be6606b79e24d4e4d80516cef0e718a87067153089765ce61bb68902f038e11789fcc70ee70ea42c7c0c291a81a26dcf74b606c722ac217c48675c22

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MsBiQgMw.dat

    Filesize

    2B

    MD5

    84cad01fdb44ae58dbe6c3973dcd87f5

    SHA1

    4700b42849fb35be323774820bf1bc8019d26c80

    SHA256

    8b1f194be530240c18bf0b1ee0d038e750fab8b24c6bd25c864297e5ebb41fa6

    SHA512

    6e10d3ec4724c1aca9ff3f6a26292ba80065d18e8e9395f1474c0a298008f25e312e2f7024e7d10aab3264764e69a25553cc20afd23090f83921d20e42b989ab

  • C:\Users\Admin\AppData\Roaming\toulse\foul.exe

    Filesize

    60KB

    MD5

    b0c2efab0ab3ef4157cd97a2ff8f775e

    SHA1

    9bb85026c7a9037e3ae8634a66d3f954ef3f49c3

    SHA256

    69d873035398746e59c747af9920196bd9fc117ad25196475d64b5a96ff32ce2

    SHA512

    6d33f4eb4a0ea627fa351a13dff0f1281e916a8084362d9c2e981e284271bf1cca40fd2d1c8ac19ef3db5bb54377bdfe359be0151573220352e14bbcd3f9fb56

  • memory/484-88-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/484-86-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/568-68-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/848-107-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/1052-60-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/1228-39-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/1228-41-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/1524-98-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/1524-96-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/1588-59-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/1588-61-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/1652-69-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/1652-67-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2056-31-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2200-97-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2228-5-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2228-4-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2264-10-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2332-108-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2332-106-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2364-76-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2364-78-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2368-116-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2368-118-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2512-50-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2552-117-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2600-30-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2600-32-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2620-77-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2632-40-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2708-22-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2772-12-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2772-9-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2852-87-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2988-21-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/2988-24-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/3064-51-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB

  • memory/3064-49-0x0000000000C80000-0x0000000000C97000-memory.dmp

    Filesize

    92KB