Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-01-2025 02:51
General
-
Target
JaffaCakes118_68c0fcb8b0149c81b289679cc2bb4d60.exe
-
Size
33KB
-
MD5
68c0fcb8b0149c81b289679cc2bb4d60
-
SHA1
b5e38e0018561e370cd06fcfac7c14e58180b921
-
SHA256
299472330486bec60f0822893c8d564c86c7b0be30abf84088137717c511c269
-
SHA512
d45c848ac0fb29299b65ac5afe2e2de58ead648570130ae93ec84492da6929fe41abe149b2897b7a9192de28b9c8729d98c23be3fd4ae67470637bc7510d48f4
-
SSDEEP
768:yMuijtHf5g7/IIG3bGcYDBSvFIWuePQDGEsgRMdd5r04LHAfJHe:vNW71rcYDAWeoDrsEud5rFLHiH
Malware Config
Extracted
xtremerat
h1r05h1m4.sytes.net
Signatures
-
Detect XtremeRAT payload 1 IoCs
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_68c0fcb8b0149c81b289679cc2bb4d60.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_68c0fcb8b0149c81b289679cc2bb4d60.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
308KB
-
Filesize
308KB