Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 17:21
Behavioral task
behavioral1
Sample
232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe
-
Size
44KB
-
MD5
232dac1d9fc750d6e8fd0848a701cc5b
-
SHA1
1d4f3ea8aadfec33046b230e7a42f89c925e4120
-
SHA256
c9b58b9d8b35dfe055b94f30db012ece8b261c29caee459b328f5141529ee07d
-
SHA512
67c5020c4bc608db8d82e2563f70ecf19aae72e3853a2a7fbbc13f53e962a32f1d1e7983d345073d962c44f72c6f4a80209dd95a7cddc7738ca351006eadee83
-
SSDEEP
768:rBr+tjFqTPkAlfztB1lr6an3smTA8uvm2DfOTwYPImzo6J:FyRUHlrL1lr6an3TLuvm2buQ6o6J
Malware Config
Extracted
xtremerat
ali0595.no-ip.biz
Signatures
-
Detect XtremeRAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1756-3-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat C:\Windows\SysWOW64\InstallDir\Server.exe family_xtremerat behavioral2/memory/4176-5-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2608-6-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/4176-8-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
svchost.exe232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{S4VMTSJ8-GJ06-ST51-UK6V-H62M7I12BFWM}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{S4VMTSJ8-GJ06-ST51-UK6V-H62M7I12BFWM} 232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{S4VMTSJ8-GJ06-ST51-UK6V-H62M7I12BFWM}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" 232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{S4VMTSJ8-GJ06-ST51-UK6V-H62M7I12BFWM} svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" 232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" 232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" svchost.exe -
Drops file in System32 directory 2 IoCs
Processes:
232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\InstallDir\Server.exe 232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallDir\Server.exe 232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid process 4176 explorer.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exedescription pid process target process PID 2608 wrote to memory of 1756 2608 232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe svchost.exe PID 2608 wrote to memory of 1756 2608 232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe svchost.exe PID 2608 wrote to memory of 1756 2608 232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe svchost.exe PID 2608 wrote to memory of 1756 2608 232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe svchost.exe PID 2608 wrote to memory of 4176 2608 232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe explorer.exe PID 2608 wrote to memory of 4176 2608 232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe explorer.exe PID 2608 wrote to memory of 4176 2608 232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe explorer.exe PID 2608 wrote to memory of 4176 2608 232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\232dac1d9fc750d6e8fd0848a701cc5b_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\InstallDir\Server.exeFilesize
44KB
MD5232dac1d9fc750d6e8fd0848a701cc5b
SHA11d4f3ea8aadfec33046b230e7a42f89c925e4120
SHA256c9b58b9d8b35dfe055b94f30db012ece8b261c29caee459b328f5141529ee07d
SHA51267c5020c4bc608db8d82e2563f70ecf19aae72e3853a2a7fbbc13f53e962a32f1d1e7983d345073d962c44f72c6f4a80209dd95a7cddc7738ca351006eadee83
-
memory/1756-3-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2608-6-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/4176-5-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/4176-8-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB