Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2025, 05:30
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe
-
Size
36KB
-
MD5
0ac0ffcca354d86416b46dbe4a9a5e84
-
SHA1
e40b5d19b2340ad2a739391f969912d43a0d93d8
-
SHA256
bc771a151e702b46e62755760588a27402d8d434f7489d78a7a53de6bd92ef63
-
SHA512
50aaadd9055a4dacf43bf18adf72e12ec71778dd03ee07afd2509473460a86f0e3ff4eca8ae1bf13636f1e0f8ed6c500d03df184c73aba53d1c088071904ebd9
-
SSDEEP
768:O1PWaaTmypGPRihzo1J+DqSVKZILneRg0ZLJySidfI:I+aaq3VQqKre/ZeI
Malware Config
Extracted
xtremerat
loveayada.zapto.org
Signatures
-
Detect XtremeRAT payload 3 IoCs
resource yara_rule behavioral2/memory/4044-6-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral2/memory/4460-13-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral2/memory/4044-16-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat -
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/2296-3-0x0000000010000000-0x0000000010014000-memory.dmp modiloader_stage2 -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{02JF873B-CW12-LN74-D888-26OOGWBY154H} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02JF873B-CW12-LN74-D888-26OOGWBY154H}\StubPath = "C:\\Windows\\InstallDir\\windos.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{02JF873B-CW12-LN74-D888-26OOGWBY154H} JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02JF873B-CW12-LN74-D888-26OOGWBY154H}\StubPath = "C:\\Windows\\InstallDir\\windos.exe restart" JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\windos.exe" JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\windos.exe" JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\windos.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\windos.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2296 set thread context of 4044 2296 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 83 -
resource yara_rule behavioral2/memory/4044-2-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/4044-5-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/4044-6-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/4460-13-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/4044-16-0x0000000000C80000-0x0000000000C96000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\InstallDir\windos.exe JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe File created C:\Windows\InstallDir\windos.exe JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe File opened for modification C:\Windows\InstallDir\ JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2296 wrote to memory of 4044 2296 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 83 PID 2296 wrote to memory of 4044 2296 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 83 PID 2296 wrote to memory of 4044 2296 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 83 PID 2296 wrote to memory of 4044 2296 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 83 PID 2296 wrote to memory of 4044 2296 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 83 PID 4044 wrote to memory of 4460 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 84 PID 4044 wrote to memory of 4460 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 84 PID 4044 wrote to memory of 4460 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 84 PID 4044 wrote to memory of 4460 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 84 PID 4044 wrote to memory of 2004 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 85 PID 4044 wrote to memory of 2004 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 85 PID 4044 wrote to memory of 2004 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 85 PID 4044 wrote to memory of 5024 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 86 PID 4044 wrote to memory of 5024 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 86 PID 4044 wrote to memory of 5024 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 86 PID 4044 wrote to memory of 1804 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 87 PID 4044 wrote to memory of 1804 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 87 PID 4044 wrote to memory of 1804 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 87 PID 4044 wrote to memory of 4524 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 88 PID 4044 wrote to memory of 4524 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 88 PID 4044 wrote to memory of 4524 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 88 PID 4044 wrote to memory of 1976 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 89 PID 4044 wrote to memory of 1976 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 89 PID 4044 wrote to memory of 1976 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 89 PID 4044 wrote to memory of 4780 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 90 PID 4044 wrote to memory of 4780 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 90 PID 4044 wrote to memory of 4780 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 90 PID 4044 wrote to memory of 2256 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 93 PID 4044 wrote to memory of 2256 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 93 PID 4044 wrote to memory of 2256 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 93 PID 4044 wrote to memory of 3484 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 94 PID 4044 wrote to memory of 3484 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 94 PID 4044 wrote to memory of 3484 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 94 PID 4044 wrote to memory of 3140 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 95 PID 4044 wrote to memory of 3140 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 95 PID 4044 wrote to memory of 3140 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 95 PID 4044 wrote to memory of 1352 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 100 PID 4044 wrote to memory of 1352 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 100 PID 4044 wrote to memory of 1352 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 100 PID 4044 wrote to memory of 2920 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 101 PID 4044 wrote to memory of 2920 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 101 PID 4044 wrote to memory of 2920 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 101 PID 4044 wrote to memory of 1688 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 102 PID 4044 wrote to memory of 1688 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 102 PID 4044 wrote to memory of 1688 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 102 PID 4044 wrote to memory of 3412 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 103 PID 4044 wrote to memory of 3412 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 103 PID 4044 wrote to memory of 3412 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 103 PID 4044 wrote to memory of 4932 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 104 PID 4044 wrote to memory of 4932 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 104 PID 4044 wrote to memory of 4932 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 104 PID 4044 wrote to memory of 3880 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 105 PID 4044 wrote to memory of 3880 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 105 PID 4044 wrote to memory of 3880 4044 JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ac0ffcca354d86416b46dbe4a9a5e84.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4460
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:2004
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:5024
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:1804
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:4524
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:1976
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:4780
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:2256
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:3484
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:3140
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:1352
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:2920
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:1688
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:3412
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:4932
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:3880
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD50ac0ffcca354d86416b46dbe4a9a5e84
SHA1e40b5d19b2340ad2a739391f969912d43a0d93d8
SHA256bc771a151e702b46e62755760588a27402d8d434f7489d78a7a53de6bd92ef63
SHA51250aaadd9055a4dacf43bf18adf72e12ec71778dd03ee07afd2509473460a86f0e3ff4eca8ae1bf13636f1e0f8ed6c500d03df184c73aba53d1c088071904ebd9