Overview

overview

10

Static

static

10

f4d748d752...18.exe

windows7-x64

10

f4d748d752...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    103s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-12-2024 16:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f4d748d7529d0277ca17883e9fab812c_JaffaCakes118.exe

  • Size

    40KB

  • MD5

    f4d748d7529d0277ca17883e9fab812c

  • SHA1

    af642e6aa8227026696f106ec1661246462a1145

  • SHA256

    1521cc81e3e9bc81a6b3ab07380e7e3a56093e3fa88207b71facbe3a72777e37

  • SHA512

    10ae1bd9a8385708d1867de24129bfdefff72909b57606ffdd9e92c4e608462eafbff4d896eb65d3072becdcb25ed359ff33db0c443a7ba980947ee445ffee6f

  • SSDEEP

    768:cE9h7hdN12Ozhiow2Gkm6jc3/pBzNBwIldMzoc:cuNzMOlw2GkmF3/Bld8oc

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Signatures

  • Detect XtremeRAT payload 1 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat
  • Xtremerat family
    xtremerat
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4d748d7529d0277ca17883e9fab812c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f4d748d7529d0277ca17883e9fab812c_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1668-0-0x0000000000C80000-0x0000000000C92000-memory.dmp

    Filesize

    72KB

    Download