Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-12-2024 23:59
Static task
static1
Behavioral task
behavioral1
Sample
cfaf2f9f41187d2c3bde26abd44943ed_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
cfaf2f9f41187d2c3bde26abd44943ed_JaffaCakes118.exe
-
Size
71KB
-
MD5
cfaf2f9f41187d2c3bde26abd44943ed
-
SHA1
0adf4ec0d322e9c4276c87e8e6a08cf41da60d54
-
SHA256
53650090b9038f83f9d9cb64768876abf59f6c0ad22fbb97050644ef09841a7a
-
SHA512
a6ce8955690870b4fe85a2bf78085e2a97f17a834b83f46fc6ae29c51bdfc5417058b60400e93c7b3c05fc4e1511c73424a8c9d3b668f8e56a19f42a9721e962
-
SSDEEP
1536:ObtbI4ZmN264cDWrZ9q5npFy5k1ufvrMK9SCgCnOV35:ObV4WrZIlKkAfvrMKthIp
Malware Config
Extracted
xtremerat
Create sebirkan99.no-ip.biz
Signatures
-
Detect XtremeRAT payload 5 IoCs
resource yara_rule behavioral1/memory/1728-32-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/1728-30-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/2904-37-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/1728-38-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/2904-39-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Executes dropped EXE 2 IoCs
pid Process 2280 hilem.exe 1728 hilem.exe -
Loads dropped DLL 3 IoCs
pid Process 2124 cfaf2f9f41187d2c3bde26abd44943ed_JaffaCakes118.exe 2124 cfaf2f9f41187d2c3bde26abd44943ed_JaffaCakes118.exe 2280 hilem.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2280 set thread context of 1728 2280 hilem.exe 29 -
resource yara_rule behavioral1/files/0x0008000000012117-5.dat upx behavioral1/memory/2280-14-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2280-34-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1728-32-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/1728-31-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1728-30-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/1728-29-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/1728-26-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/1728-23-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/1728-22-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2904-37-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/1728-38-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2904-39-0x0000000010000000-0x000000001004D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hilem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cfaf2f9f41187d2c3bde26abd44943ed_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hilem.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2124 cfaf2f9f41187d2c3bde26abd44943ed_JaffaCakes118.exe 2280 hilem.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2280 2124 cfaf2f9f41187d2c3bde26abd44943ed_JaffaCakes118.exe 28 PID 2124 wrote to memory of 2280 2124 cfaf2f9f41187d2c3bde26abd44943ed_JaffaCakes118.exe 28 PID 2124 wrote to memory of 2280 2124 cfaf2f9f41187d2c3bde26abd44943ed_JaffaCakes118.exe 28 PID 2124 wrote to memory of 2280 2124 cfaf2f9f41187d2c3bde26abd44943ed_JaffaCakes118.exe 28 PID 2280 wrote to memory of 1728 2280 hilem.exe 29 PID 2280 wrote to memory of 1728 2280 hilem.exe 29 PID 2280 wrote to memory of 1728 2280 hilem.exe 29 PID 2280 wrote to memory of 1728 2280 hilem.exe 29 PID 2280 wrote to memory of 1728 2280 hilem.exe 29 PID 2280 wrote to memory of 1728 2280 hilem.exe 29 PID 2280 wrote to memory of 1728 2280 hilem.exe 29 PID 2280 wrote to memory of 1728 2280 hilem.exe 29 PID 1728 wrote to memory of 2904 1728 hilem.exe 30 PID 1728 wrote to memory of 2904 1728 hilem.exe 30 PID 1728 wrote to memory of 2904 1728 hilem.exe 30 PID 1728 wrote to memory of 2904 1728 hilem.exe 30 PID 1728 wrote to memory of 2904 1728 hilem.exe 30 PID 1728 wrote to memory of 2928 1728 hilem.exe 31 PID 1728 wrote to memory of 2928 1728 hilem.exe 31 PID 1728 wrote to memory of 2928 1728 hilem.exe 31 PID 1728 wrote to memory of 2928 1728 hilem.exe 31 PID 1728 wrote to memory of 2928 1728 hilem.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfaf2f9f41187d2c3bde26abd44943ed_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cfaf2f9f41187d2c3bde26abd44943ed_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\hilem.exe"C:\Users\Admin\AppData\Local\Temp\hilem.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\hilem.exe
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵
- System Location Discovery: System Language Discovery
PID:2904
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:2928
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD5e3919a4d64f3979d6c606daab9622f09
SHA18b3213b163083c142fe6a2fec15624c63f71ca39
SHA2569bcf15e7fd751f7c380c88a484b41964c3b55d31cdca912e9c2bae2f2eb4a84c
SHA512071dad0b1b944b1a3506afba358266fa9e449564c6d19b078c6d0c69b7d19c97471f47bdf7a8c09fd1f9d2286002ce0d18b87f52f0f7cacd062f28511da52c49