xtremerat | aebcee73ed752e334da81ddbbfa30cf0e42dab6b9b25271244d03247239f8149

General

Target

e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
Size

85KB
MD5

e89200d7feab7de79a4be3045e3033a0
SHA1

15116bda4d6dce12ce15371c61806d65c9d0ecde
SHA256

aebcee73ed752e334da81ddbbfa30cf0e42dab6b9b25271244d03247239f8149
SHA512

eb2c5bf0a649d019563a3048e988397b550a5ed96383a14a49de6592d082aa28fbaa8bb2b96e8f4805f5aa58a0501f9cdca429d84ebbaa8f0121c87ed36eaca0
SSDEEP

1536:Wd22wdjPAtpRQSQcs7QXFEmZQQGfjswHgEv0xlBkhB+Z+EuE:WU2wdklHFX6m6rLfAEv0xlBkf+YEb

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2464-17-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat
behavioral1/memory/2464-18-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat
behavioral1/memory/2600-21-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat
behavioral1/memory/2524-24-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat
behavioral1/memory/2464-25-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat
behavioral1/memory/2524-28-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat
behavioral1/memory/2524-29-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat
behavioral1/memory/2600-31-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat
behavioral1/memory/2524-32-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

notepad.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	notepad.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	notepad.exe

Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

2524 notepad.exe

pid	process
2524	notepad.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2464-9-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral1/memory/2464-10-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral1/memory/2464-13-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral1/memory/2464-16-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral1/memory/2464-17-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral1/memory/2464-18-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral1/memory/2600-21-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral1/memory/2524-24-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral1/memory/2464-25-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral1/memory/2524-28-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral1/memory/2524-29-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral1/memory/2600-31-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral1/memory/2524-32-0x0000000010000000-0x000000001004B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

notepad.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	notepad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	notepad.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe

description	pid	process	target process
PID 1660 set thread context of 2464	1660	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

Processes:

notepad.exe

description	ioc	process
File opened for modification	C:\Windows\InstallDir\Server.exe	notepad.exe
File created	C:\Windows\InstallDir\Server.exe	notepad.exe
File opened for modification	C:\Windows\InstallDir\	notepad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exenotepad.exe

pid process

1660 e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
2524 notepad.exe

pid	process
1660	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
2524	notepad.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exee89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe

description	pid	process	target process
PID 1660 wrote to memory of 2464	1660	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 1660 wrote to memory of 2464	1660	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 1660 wrote to memory of 2464	1660	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 1660 wrote to memory of 2464	1660	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 1660 wrote to memory of 2464	1660	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 1660 wrote to memory of 2464	1660	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 1660 wrote to memory of 2464	1660	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 1660 wrote to memory of 2464	1660	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 2464 wrote to memory of 2600	2464	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	svchost.exe
PID 2464 wrote to memory of 2600	2464	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	svchost.exe
PID 2464 wrote to memory of 2600	2464	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	svchost.exe
PID 2464 wrote to memory of 2600	2464	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	svchost.exe
PID 2464 wrote to memory of 2600	2464	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	svchost.exe
PID 2464 wrote to memory of 2524	2464	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	notepad.exe
PID 2464 wrote to memory of 2524	2464	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	notepad.exe
PID 2464 wrote to memory of 2524	2464	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	notepad.exe
PID 2464 wrote to memory of 2524	2464	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	notepad.exe
PID 2464 wrote to memory of 2524	2464	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660

C:\Users\Admin\AppData\Local\Temp\e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:2600

C:\Windows\SysWOW64\notepad.exe
notepad.exe
3⤵
- Modifies Installed Components in the registry
- Deletes itself
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2524

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\InstallDir\Server.exe
Filesize
85KB

MD5
e89200d7feab7de79a4be3045e3033a0

SHA1
15116bda4d6dce12ce15371c61806d65c9d0ecde

SHA256
aebcee73ed752e334da81ddbbfa30cf0e42dab6b9b25271244d03247239f8149

SHA512
eb2c5bf0a649d019563a3048e988397b550a5ed96383a14a49de6592d082aa28fbaa8bb2b96e8f4805f5aa58a0501f9cdca429d84ebbaa8f0121c87ed36eaca0

Download Submit
memory/1660-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1660-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1660-2-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1660-3-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1660-4-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1660-5-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1660-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2464-13-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2464-25-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2464-10-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2464-9-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2464-16-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2464-17-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2464-18-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2464-8-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2464-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2524-28-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2524-24-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2524-29-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2524-32-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2600-21-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2600-31-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads