Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 13:26
General
- Target jaffacakes118_Worm.Win32.WBNA.ipa.exe
- Size 740KB
- Sample261014-qpp72sdv5m
- SHA256 4f068df60064234159a0cacb33563e2def56b10b5c5e23673799f7c707a7d878
Malware Config
Signatures
- Family: XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
- Detect XtremeRAT payload 2 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Worm.Win32.WBNA.ipa.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Worm.Win32.WBNA.ipa.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Worm.Win32.WBNA.ipa.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_Worm.Win32.WBNA.ipa.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/1552-47-0x0000000013140000-0x000000001315C000-memory.dmp
memory/1552-48-0x0000000013140000-0x000000001315C000-memory.dmp
memory/2588-4-0x0000000002570000-0x0000000002571000-memory.dmp
memory/2588-2-0x0000000002410000-0x0000000002411000-memory.dmp
memory/2588-16-0x0000000003430000-0x0000000003431000-memory.dmp
memory/2588-14-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2588-13-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2588-12-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2588-11-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2588-10-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2588-9-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2588-7-0x0000000002580000-0x0000000002581000-memory.dmp
memory/2588-0-0x0000000000400000-0x0000000000535000-memory.dmp
memory/2588-3-0x00000000023F0000-0x00000000023F1000-memory.dmp
memory/2588-27-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-8-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2588-5-0x0000000002430000-0x0000000002431000-memory.dmp
memory/2588-18-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-20-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-24-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-28-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-32-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-31-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-30-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-15-0x0000000003430000-0x0000000003431000-memory.dmp
memory/2588-29-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-40-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-25-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-23-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-22-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-19-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-35-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-34-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-26-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-41-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-46-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-6-0x00000000023E0000-0x00000000023E1000-memory.dmp
memory/2588-51-0x0000000000400000-0x0000000000535000-memory.dmp
memory/2588-50-0x00000000021D0000-0x0000000002230000-memory.dmp
memory/2588-1-0x00000000021D0000-0x0000000002230000-memory.dmp
memory/2588-45-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-44-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-43-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-42-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-39-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-38-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-33-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-17-0x0000000003430000-0x0000000003530000-memory.dmp
memory/2588-21-0x0000000003430000-0x0000000003530000-memory.dmp