Analysis

  • max time kernel
    93s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-12-2024 20:17

General

  • Target

    db5aef4f5492fbe3b91ee8378990fda8_JaffaCakes118.exe

  • Size

    61KB

  • MD5

    db5aef4f5492fbe3b91ee8378990fda8

  • SHA1

    4f8cfbc766546c901db03e5caf6f8ee68eac80f2

  • SHA256

    c78f808fa6c3a643232b4d3c5f88e2b396e1ffca54d42ddd2771fe70a222fa3f

  • SHA512

    80b07f0a6a4a7e66a6fd7151e05fa68b0b7860a486735820d233a7505f0bc341cf0fd84a047fe7bccdb831b931cf70cbd6a7b1e5d9b5645494c6dd0f69287f12

  • SSDEEP

    1536:pT8qDqQ8K9MKhuiUMKgP2koJxg8tl5NXx:tqMyKQLLg8/V

Malware Config

Extracted

Family

xtremerat

C2

amhi.no-ip.info

Signatures

  • Detect XtremeRAT payload 4 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Xtremerat family
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db5aef4f5492fbe3b91ee8378990fda8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\db5aef4f5492fbe3b91ee8378990fda8_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4436
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3712
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 480
        3⤵
        • Program crash
        PID:3592
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 488
        3⤵
        • Program crash
        PID:224
    • C:\Windows\SysWOW64\notepad.exe
      notepad.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4680
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 480
        3⤵
        • Program crash
        PID:4936
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 488
        3⤵
        • Program crash
        PID:508
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3712 -ip 3712
    1⤵
      PID:4940
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4680 -ip 4680
      1⤵
        PID:1796
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4680 -ip 4680
        1⤵
          PID:1992
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3712 -ip 3712
          1⤵
            PID:1772

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/3712-0-0x0000000010000000-0x0000000010047000-memory.dmp

            Filesize

            284KB

          • memory/3712-4-0x0000000010000000-0x0000000010047000-memory.dmp

            Filesize

            284KB

          • memory/4436-2-0x0000000010000000-0x0000000010047000-memory.dmp

            Filesize

            284KB

          • memory/4680-1-0x0000000010000000-0x0000000010047000-memory.dmp

            Filesize

            284KB