xtremerat | c59f63a6ac9ac434dd9e414e9a088a3196c9a6a9756ff087034eae49fd08a676

General

Target

e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
Size

377KB
MD5

e52157c7d5b90e4cb0a526920f9c4bba
SHA1

7cb4d04789929ddbd2328b6ae155dd778a30b7c2
SHA256

c59f63a6ac9ac434dd9e414e9a088a3196c9a6a9756ff087034eae49fd08a676
SHA512

9eebf6523a9ee21699e926bf6daa8d474564fc2520425fd0b3e7a187b1ec2a223d51a45680a201368e5cee2133b883d0e2d4a4c544006c1ffbdc938ae30feb9d
SSDEEP

6144:/2n8tZ8hI966AGkAjOpoaY7nEd/o5Z4HwK7MnDXPvMUKARegsaHJHTc8gNmEk:/2dq6xGJOpqbEu8GTPvMUjxdc8gNm

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

C2

far3on.zapto.org

Signatures

Detect XtremeRAT payload 12 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2604-45-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2604-46-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2604-47-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2604-48-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2604-49-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2604-52-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2604-54-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2604-57-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2604-58-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2764-61-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2604-62-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2764-63-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 2 IoCs

Processes:

e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exee52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE

description	pid	process	target process
PID 2752 set thread context of 2668	2752	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE
PID 2668 set thread context of 2604	2668	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exee52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE

pid process

2752 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
2668 e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE

pid	process
2752	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
2668	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exee52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXEe52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752

C:\Users\Admin\AppData\Local\Temp\e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE
"C:\Users\Admin\AppData\Local\Temp\e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668

C:\Users\Admin\AppData\Local\Temp\e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2604

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:2764

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:1948

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2604-50-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2604-58-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2604-49-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2604-48-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2604-54-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2604-55-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2604-43-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2604-52-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2604-44-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2604-62-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2604-57-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2604-47-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2604-46-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2604-45-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2668-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2668-42-0x0000000002580000-0x00000000025F4000-memory.dmp

Filesize
464KB

Download
memory/2668-53-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2668-34-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2752-27-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-24-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-20-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-19-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-18-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-17-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-16-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-15-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-14-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-13-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-12-0x00000000034C0000-0x00000000034E6000-memory.dmp

Filesize
152KB

Download
memory/2752-11-0x00000000034C0000-0x00000000034E6000-memory.dmp

Filesize
152KB

Download
memory/2752-10-0x00000000034C0000-0x00000000034E6000-memory.dmp

Filesize
152KB

Download
memory/2752-9-0x00000000034C0000-0x00000000034E6000-memory.dmp

Filesize
152KB

Download
memory/2752-22-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-35-0x00000000035F0000-0x0000000003664000-memory.dmp

Filesize
464KB

Download
memory/2752-23-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-37-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2752-39-0x00000000002E0000-0x000000000033A000-memory.dmp

Filesize
360KB

Download
memory/2752-21-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-25-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-26-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2752-28-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-29-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-30-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-31-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-32-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2752-33-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2752-8-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2752-7-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2752-6-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/2752-5-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/2752-1-0x00000000002E0000-0x000000000033A000-memory.dmp

Filesize
360KB

Download
memory/2752-3-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/2764-61-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2764-63-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download

description	pid	process	target process
PID 2752 wrote to memory of 2668	2752	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE
PID 2752 wrote to memory of 2668	2752	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE
PID 2752 wrote to memory of 2668	2752	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE
PID 2752 wrote to memory of 2668	2752	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE
PID 2752 wrote to memory of 2668	2752	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE
PID 2752 wrote to memory of 2668	2752	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE
PID 2752 wrote to memory of 2668	2752	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE
PID 2752 wrote to memory of 2668	2752	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE
PID 2752 wrote to memory of 2668	2752	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE
PID 2668 wrote to memory of 2604	2668	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
PID 2668 wrote to memory of 2604	2668	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
PID 2668 wrote to memory of 2604	2668	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
PID 2668 wrote to memory of 2604	2668	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
PID 2668 wrote to memory of 2604	2668	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
PID 2668 wrote to memory of 2604	2668	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
PID 2668 wrote to memory of 2604	2668	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
PID 2668 wrote to memory of 2604	2668	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
PID 2668 wrote to memory of 2604	2668	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
PID 2668 wrote to memory of 2604	2668	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
PID 2668 wrote to memory of 2604	2668	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
PID 2668 wrote to memory of 2604	2668	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.EXE	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe
PID 2604 wrote to memory of 2764	2604	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	svchost.exe
PID 2604 wrote to memory of 2764	2604	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	svchost.exe
PID 2604 wrote to memory of 2764	2604	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	svchost.exe
PID 2604 wrote to memory of 2764	2604	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	svchost.exe
PID 2604 wrote to memory of 2764	2604	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	svchost.exe
PID 2604 wrote to memory of 1948	2604	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	iexplore.exe
PID 2604 wrote to memory of 1948	2604	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	iexplore.exe
PID 2604 wrote to memory of 1948	2604	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	iexplore.exe
PID 2604 wrote to memory of 1948	2604	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	iexplore.exe
PID 2604 wrote to memory of 1948	2604	e52157c7d5b90e4cb0a526920f9c4bba_JaffaCakes118.exe	iexplore.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads