Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-01-2025 09:27

General

  • Target

    JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe

  • Size

    668KB

  • MD5

    78eb8e5963914f564140c75bb030cdd0

  • SHA1

    cd53c928dd332bb40fdef34287c4239eff468a4a

  • SHA256

    0f1f093ac8ac55db7f3d28310ab2b9b92aed9431cfa09ab18d0b0e31f6505815

  • SHA512

    c374efe1e2dc1350649e445fd335a667bf29ffe7a7ad2672eb04e995bee8c763dea81360113e1e55275f4c40a59d956d4677939161bc5c7cadb2a91cb152b2a9

  • SSDEEP

    12288:POqBSJNJ/+EkGz1lr3nxGteN4r3t8UOGz624SitfLmygYp0:2CScE7z193Rit8UJ62Bmhgo0

Malware Config

Extracted

Family

xtremerat

C2

gkl7.no-ip.biz

Signatures

  • Detect XtremeRAT payload 15 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Xtremerat family
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 21 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4660
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:1456
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          3⤵
            PID:396
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe
            3⤵
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1676
            • C:\Windows\SysWOW64\InstallDir\Sv.exe
              "C:\Windows\system32\InstallDir\Sv.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4912
              • C:\Windows\SysWOW64\InstallDir\Sv.exe
                C:\Windows\SysWOW64\InstallDir\Sv.exe
                5⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1144
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  6⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Checks SCSI registry key(s)
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:3248

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

        Filesize

        1KB

        MD5

        f0430d974b0838d63599bf40647a7ae6

        SHA1

        68c7184c6f4ab0de36d249bd852ea59fd82a24e5

        SHA256

        d88335f0154f4022260fb00795fc2b92ccab16c482b8b3dafe6e4ff563ad39b9

        SHA512

        df17c4a0ab142315932d4da894ecdbb9423575bc7b6b5edf6880722787eb6d546ef0de1fd82576aa20be4edb8bfd0ff5b2c34dc0ce7d0e9f615976c6a981f5e1

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).dat

        Filesize

        2B

        MD5

        84cad01fdb44ae58dbe6c3973dcd87f5

        SHA1

        4700b42849fb35be323774820bf1bc8019d26c80

        SHA256

        8b1f194be530240c18bf0b1ee0d038e750fab8b24c6bd25c864297e5ebb41fa6

        SHA512

        6e10d3ec4724c1aca9ff3f6a26292ba80065d18e8e9395f1474c0a298008f25e312e2f7024e7d10aab3264764e69a25553cc20afd23090f83921d20e42b989ab

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).xtr

        Filesize

        343KB

        MD5

        6426d400c96fb9ffef4eaa54f6647f4c

        SHA1

        70a37871aff432790b6adf7d3fc4eb929476e082

        SHA256

        98bba0cf4c57ecd35b227f45e4aa6dd50ef7cfb1160235cc14687c96eb09fa3c

        SHA512

        2c8b4d3ab066cbfca6cf0c8d89d5044152b5e3d7100249cbedd1c816e3a4a94efc8bc6b79c1dab4bdf96e3ce476d6caccf625cfbe0aff3bf5e7a29dfcfa948c5

      • C:\Windows\SysWOW64\InstallDir\Sv.exe

        Filesize

        668KB

        MD5

        78eb8e5963914f564140c75bb030cdd0

        SHA1

        cd53c928dd332bb40fdef34287c4239eff468a4a

        SHA256

        0f1f093ac8ac55db7f3d28310ab2b9b92aed9431cfa09ab18d0b0e31f6505815

        SHA512

        c374efe1e2dc1350649e445fd335a667bf29ffe7a7ad2672eb04e995bee8c763dea81360113e1e55275f4c40a59d956d4677939161bc5c7cadb2a91cb152b2a9

      • memory/1144-46-0x0000000000C80000-0x0000000000CE9000-memory.dmp

        Filesize

        420KB

      • memory/1676-19-0x0000000000C80000-0x0000000000CE9000-memory.dmp

        Filesize

        420KB

      • memory/1676-34-0x0000000000C80000-0x0000000000CE9000-memory.dmp

        Filesize

        420KB

      • memory/1676-29-0x0000000000C80000-0x0000000000CE9000-memory.dmp

        Filesize

        420KB

      • memory/1676-23-0x0000000000C80000-0x0000000000CE9000-memory.dmp

        Filesize

        420KB

      • memory/3248-60-0x0000000001610000-0x0000000001712000-memory.dmp

        Filesize

        1.0MB

      • memory/3248-62-0x0000000001610000-0x0000000001712000-memory.dmp

        Filesize

        1.0MB

      • memory/3248-70-0x0000000001610000-0x0000000001712000-memory.dmp

        Filesize

        1.0MB

      • memory/3248-67-0x0000000001610000-0x0000000001712000-memory.dmp

        Filesize

        1.0MB

      • memory/3248-66-0x0000000001610000-0x0000000001712000-memory.dmp

        Filesize

        1.0MB

      • memory/3248-65-0x0000000001610000-0x0000000001712000-memory.dmp

        Filesize

        1.0MB

      • memory/3248-64-0x0000000001610000-0x0000000001712000-memory.dmp

        Filesize

        1.0MB

      • memory/3248-61-0x0000000001610000-0x0000000001712000-memory.dmp

        Filesize

        1.0MB

      • memory/3248-59-0x0000000001610000-0x0000000001712000-memory.dmp

        Filesize

        1.0MB

      • memory/3248-56-0x0000000001610000-0x0000000001712000-memory.dmp

        Filesize

        1.0MB

      • memory/3248-57-0x0000000001610000-0x0000000001712000-memory.dmp

        Filesize

        1.0MB

      • memory/3248-55-0x0000000001610000-0x0000000001712000-memory.dmp

        Filesize

        1.0MB

      • memory/3460-11-0x0000000023240000-0x000000002326A000-memory.dmp

        Filesize

        168KB

      • memory/4660-0-0x0000000000C80000-0x0000000000CE9000-memory.dmp

        Filesize

        420KB

      • memory/4660-9-0x0000000000C80000-0x0000000000CE9000-memory.dmp

        Filesize

        420KB

      • memory/4660-5-0x0000000000C80000-0x0000000000CE9000-memory.dmp

        Filesize

        420KB

      • memory/4660-3-0x0000000000C80000-0x0000000000CE9000-memory.dmp

        Filesize

        420KB

      • memory/4660-1-0x0000000000C80000-0x0000000000CE9000-memory.dmp

        Filesize

        420KB

      • memory/4660-10-0x0000000000C80000-0x0000000000CE9000-memory.dmp

        Filesize

        420KB

      • memory/4660-12-0x0000000000C80000-0x0000000000CE9000-memory.dmp

        Filesize

        420KB

      • memory/4660-6-0x0000000000C80000-0x0000000000CE9000-memory.dmp

        Filesize

        420KB

      • memory/4660-7-0x0000000000C80000-0x0000000000CE9000-memory.dmp

        Filesize

        420KB

      • memory/4660-20-0x0000000000C80000-0x0000000000CE9000-memory.dmp

        Filesize

        420KB

      • memory/4912-35-0x0000000023240000-0x000000002326A000-memory.dmp

        Filesize

        168KB

      • memory/4912-69-0x0000000023240000-0x000000002326A000-memory.dmp

        Filesize

        168KB