Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-02-2025 00:34

General

  • Target

    JaffaCakes118_1d4876957c7273b09848839d7f9161fa.exe

  • Size

    300KB

  • MD5

    1d4876957c7273b09848839d7f9161fa

  • SHA1

    6fce17d554492814fc8b603c79ea20932caecbff

  • SHA256

    1a4755ba998b10a4a4f0db268e4324af1453c9c6d1e12998275116e691eeb850

  • SHA512

    8964ceb8e3d006192de58caf5703cd1fc7d0b3359901a898ec0b3a599029f109c058c91c48df580724287ee7348495254395b5476544890ba71ee2ed84687841

  • SSDEEP

    6144:BxOZDEYse1072Y1VjBgjcPAG/rFbYTs9IMuLq3MgqjoG53O:tYsx2Y1VjBgjANDFqsyjoY+

Malware Config

Extracted

Family

xtremerat

C2

ro1or.zapto.org

Signatures

  • Detect XtremeRAT payload 5 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Xtremerat family
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d4876957c7273b09848839d7f9161fa.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d4876957c7273b09848839d7f9161fa.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d4876957c7273b09848839d7f9161fa.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d4876957c7273b09848839d7f9161fa.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2556
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2052
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:2404

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2052-17-0x0000000010000000-0x0000000010045000-memory.dmp

      Filesize

      276KB

    • memory/2052-19-0x0000000010000000-0x0000000010045000-memory.dmp

      Filesize

      276KB

    • memory/2052-18-0x0000000010000000-0x0000000010045000-memory.dmp

      Filesize

      276KB

    • memory/2528-9-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/2528-4-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/2528-3-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/2528-1-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/2528-15-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/2528-5-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/2528-6-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/2528-0-0x0000000000401000-0x0000000000403000-memory.dmp

      Filesize

      8KB

    • memory/2556-10-0x0000000010000000-0x0000000010045000-memory.dmp

      Filesize

      276KB

    • memory/2556-12-0x0000000010000000-0x0000000010045000-memory.dmp

      Filesize

      276KB

    • memory/2556-11-0x0000000010000000-0x0000000010045000-memory.dmp

      Filesize

      276KB

    • memory/2556-13-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB