xtremerat | aebcee73ed752e334da81ddbbfa30cf0e42dab6b9b25271244d03247239f8149

General

Target

e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
Size

85KB
MD5

e89200d7feab7de79a4be3045e3033a0
SHA1

15116bda4d6dce12ce15371c61806d65c9d0ecde
SHA256

aebcee73ed752e334da81ddbbfa30cf0e42dab6b9b25271244d03247239f8149
SHA512

eb2c5bf0a649d019563a3048e988397b550a5ed96383a14a49de6592d082aa28fbaa8bb2b96e8f4805f5aa58a0501f9cdca429d84ebbaa8f0121c87ed36eaca0
SSDEEP

1536:Wd22wdjPAtpRQSQcs7QXFEmZQQGfjswHgEv0xlBkhB+Z+EuE:WU2wdklHFX6m6rLfAEv0xlBkf+YEb

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1696-12-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat
behavioral2/memory/1696-13-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat
behavioral2/memory/4132-14-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat
behavioral2/memory/2380-15-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat
behavioral2/memory/1696-16-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat
behavioral2/memory/4132-17-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1696-8-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral2/memory/1696-11-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral2/memory/1696-12-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral2/memory/1696-13-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral2/memory/4132-14-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral2/memory/2380-15-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral2/memory/1696-16-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral2/memory/4132-17-0x0000000010000000-0x000000001004B000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe

description	pid	process	target process
PID 2444 set thread context of 1696	2444	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3284	4132	WerFault.exe	svchost.exe
4788	2380	WerFault.exe	notepad.exe
788	4132	WerFault.exe	svchost.exe
2040	2380	WerFault.exe	notepad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe

pid process

2444 e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe

pid	process
2444	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exee89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe

description	pid	process	target process
PID 2444 wrote to memory of 1696	2444	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 2444 wrote to memory of 1696	2444	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 2444 wrote to memory of 1696	2444	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 2444 wrote to memory of 1696	2444	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 2444 wrote to memory of 1696	2444	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 2444 wrote to memory of 1696	2444	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 2444 wrote to memory of 1696	2444	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 2444 wrote to memory of 1696	2444	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
PID 1696 wrote to memory of 4132	1696	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	svchost.exe
PID 1696 wrote to memory of 4132	1696	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	svchost.exe
PID 1696 wrote to memory of 4132	1696	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	svchost.exe
PID 1696 wrote to memory of 4132	1696	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	svchost.exe
PID 1696 wrote to memory of 2380	1696	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	notepad.exe
PID 1696 wrote to memory of 2380	1696	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	notepad.exe
PID 1696 wrote to memory of 2380	1696	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	notepad.exe
PID 1696 wrote to memory of 2380	1696	e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444

C:\Users\Admin\AppData\Local\Temp\e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\e89200d7feab7de79a4be3045e3033a0_JaffaCakes118.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 488
4⤵
- Program crash
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 496
4⤵
- Program crash
PID:788

C:\Windows\SysWOW64\notepad.exe
notepad.exe
3⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 484
4⤵
- Program crash
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 504
4⤵
- Program crash
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4132 -ip 4132
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2380 -ip 2380
1⤵
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4132 -ip 4132
1⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2380 -ip 2380
1⤵
PID:1984

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1696-12-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/1696-8-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/1696-16-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/1696-11-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/1696-13-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2380-15-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2444-4-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2444-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2444-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2444-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2444-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2444-2-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2444-3-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4132-14-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/4132-17-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads