Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 01:09
Static task
static1
Behavioral task
behavioral1
Sample
dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe
Resource
win7-20241010-en
General
-
Target
dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe
-
Size
269KB
-
MD5
dc5362b9b39cf550b34c1272fe15b355
-
SHA1
6c60bda81bd19686165f8c2070e6e8e1a32948d5
-
SHA256
48cfbdeb4600dfd22582198b12d32538385f7a4f361281161892ff0ae2f9ccaf
-
SHA512
f45ba811f2c9072d7b54ace3bbc26295d72ba10c639e3dcc9ef986761caad660933d0bba8c24fcc3c9fb7f67901ce284a38daec4d84249fe22bef6a23a29e0ff
-
SSDEEP
3072:G/v7xIj0jsCpbqpu+IDzyyJRCvxe1ddRa53apZF8a4EvsagMGh0HDF++4B5hiSnu:MdJjrpRqrXaJ/15++shXhGTNKq8dR3Ra
Malware Config
Extracted
xtremerat
somee.no-ip.biz
Signatures
-
Detect XtremeRAT payload 4 IoCs
resource yara_rule behavioral2/memory/2640-28-0x0000000000C80000-0x0000000000CE1000-memory.dmp family_xtremerat behavioral2/memory/1188-30-0x0000000000C80000-0x0000000000CE1000-memory.dmp family_xtremerat behavioral2/memory/3992-31-0x0000000000C80000-0x0000000000CE1000-memory.dmp family_xtremerat behavioral2/memory/1188-33-0x0000000000C80000-0x0000000000CE1000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B3H462O-2D4U-1FBK-5IM1-QWQ763MI2XG1} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B3H462O-2D4U-1FBK-5IM1-QWQ763MI2XG1}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B3H462O-2D4U-1FBK-5IM1-QWQ763MI2XG1} server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B3H462O-2D4U-1FBK-5IM1-QWQ763MI2XG1}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" server.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3992 server.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\InstallDir\Server.exe server.exe File created C:\Windows\SysWOW64\InstallDir\Server.exe server.exe File opened for modification C:\Windows\SysWOW64\InstallDir\ server.exe -
resource yara_rule behavioral2/files/0x0007000000023cc0-17.dat upx behavioral2/memory/3992-20-0x0000000000C80000-0x0000000000CE1000-memory.dmp upx behavioral2/memory/2640-28-0x0000000000C80000-0x0000000000CE1000-memory.dmp upx behavioral2/memory/1188-30-0x0000000000C80000-0x0000000000CE1000-memory.dmp upx behavioral2/memory/3992-31-0x0000000000C80000-0x0000000000CE1000-memory.dmp upx behavioral2/memory/1188-33-0x0000000000C80000-0x0000000000CE1000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe File created C:\Windows\assembly\Desktop.ini dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4064 dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe Token: 33 4064 dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4064 dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe Token: 33 4064 dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4064 dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe Token: 33 4064 dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4064 dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1188 explorer.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4064 wrote to memory of 3992 4064 dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe 85 PID 4064 wrote to memory of 3992 4064 dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe 85 PID 4064 wrote to memory of 3992 4064 dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe 85 PID 3992 wrote to memory of 2640 3992 server.exe 86 PID 3992 wrote to memory of 2640 3992 server.exe 86 PID 3992 wrote to memory of 2640 3992 server.exe 86 PID 3992 wrote to memory of 2640 3992 server.exe 86 PID 3992 wrote to memory of 1188 3992 server.exe 87 PID 3992 wrote to memory of 1188 3992 server.exe 87 PID 3992 wrote to memory of 1188 3992 server.exe 87 PID 3992 wrote to memory of 1188 3992 server.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:2640
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1188
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
165KB
MD5a51f1b4db4bdd656d0c31bc77f1e9a79
SHA1f2a3e3f725a985d7d24b66bed17cb37f3c05105c
SHA25637bb3e1193f4684934a8cf62a68ffde17d044e5f6af3c2f7d6370f7e48b50a6d
SHA5128fb4ae8042a887dadb9b7a07b50e61735a75447896c24d28aaa5f811680f4db517ee606d1b1899a00c8a57104ba2ada09666cad9814abb4384ca5b22a424aaae