xtremerat | 404095c2d1b2faff39969b952eac822d1a4dc61b4c0d2e4c6db2a29870646cb0

General

Target

e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
Size

341KB
MD5

e3da07473d8361f6ee34113987b5cae7
SHA1

1eb02923a8327d9754752d8631b14c8e364ce7b7
SHA256

404095c2d1b2faff39969b952eac822d1a4dc61b4c0d2e4c6db2a29870646cb0
SHA512

c3c48a10913aa744439d908d5337b8328de6595ca63719825fe84e56d90b86a5531554eb623616dce41ae86eebe08aa1425888f7ebd200bd206e12e1973ff53a
SSDEEP

1536:l0LCEWYTuK652xCAq3TNbbYKxXWgHeHGqLGjNBsyRxpPfw1npfBHFg2l0AkSo:+LC+u+9mq+Th9gZlg2aHZ

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2788-5-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 2 IoCs

Processes:

e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

description	pid	process	target process
PID 3760 set thread context of 2596	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 set thread context of 2788	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3064	2596	WerFault.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
2408	2788	WerFault.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 3760 e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exee3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

pid process

2788 e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
2596 e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

pid	process
2788	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
2596	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760

C:\Users\Admin\AppData\Local\Temp\e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
2⤵
- Suspicious use of UnmapMainImage
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 12
3⤵
- Program crash
PID:3064

C:\Users\Admin\AppData\Local\Temp\e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
2⤵
- Suspicious use of UnmapMainImage
PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 12
3⤵
- Program crash
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2596 -ip 2596
1⤵
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2788 -ip 2788
1⤵
PID:4720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2596-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2788-5-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2788-8-0x00000000003E0000-0x00000000003E0000-memory.dmp

Download
memory/3760-0-0x0000000000EA0000-0x0000000000EFC000-memory.dmp

Filesize
368KB

Download
memory/3760-1-0x0000000075220000-0x00000000759D0000-memory.dmp

Filesize
7.7MB

Download
memory/3760-2-0x00000000058B0000-0x000000000594C000-memory.dmp

Filesize
624KB

Download
memory/3760-4-0x0000000005F00000-0x00000000064A4000-memory.dmp

Filesize
5.6MB

Download
memory/3760-7-0x0000000075220000-0x00000000759D0000-memory.dmp

Filesize
7.7MB

Download

description	pid	process	target process
PID 3760 wrote to memory of 2596	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2596	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2596	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2596	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2596	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2596	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2596	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2788	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2788	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2788	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2788	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2788	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2788	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2788	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2788	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2788	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2788	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2788	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2788	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 3760 wrote to memory of 2788	3760	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads