xtremerat | 34f4c9c05e1f7fcf10468946bb441b7a97c41d1dbd50ca1bc97b58ceb0dc769d

General

Target

eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
Size

180KB
MD5

eb7c3ce5bf1ff3caa66c477d08d0ee26
SHA1

19beea07c0d37be13bd5878562f6773967642514
SHA256

34f4c9c05e1f7fcf10468946bb441b7a97c41d1dbd50ca1bc97b58ceb0dc769d
SHA512

e3c5bc57b45109cda284d30fa1fb31f7bf7c2f213501b9af704febfc15639757222904f24a87ed857c5ebc0ccea59592413981644c000efbcc04dd9f5c3504d5
SSDEEP

3072:A9ZgImmH02FQUrTTopXe96HM0XnpvTyQvGn+nCuhTr8npE3dvvq9aGNLlcMHLKLs:+CuH02FZMA4TyQOI5JgpcvqNplcMHGLs

Score

10^/10

xtremerat bootkit persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3020-29-0x0000000000C80000-0x0000000000CF6000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe

Modifies registry class 3 IoCs

Processes:

eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe

pid process

3020 eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe

pid	process
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 3020 eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe

description	pid	process	target process
PID 3020 wrote to memory of 372	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	wininit.exe
PID 3020 wrote to memory of 372	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	wininit.exe
PID 3020 wrote to memory of 372	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	wininit.exe
PID 3020 wrote to memory of 372	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	wininit.exe
PID 3020 wrote to memory of 372	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	wininit.exe
PID 3020 wrote to memory of 372	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	wininit.exe
PID 3020 wrote to memory of 372	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	wininit.exe
PID 3020 wrote to memory of 384	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	csrss.exe
PID 3020 wrote to memory of 384	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	csrss.exe
PID 3020 wrote to memory of 384	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	csrss.exe
PID 3020 wrote to memory of 384	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	csrss.exe
PID 3020 wrote to memory of 384	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	csrss.exe
PID 3020 wrote to memory of 384	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	csrss.exe
PID 3020 wrote to memory of 384	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	csrss.exe
PID 3020 wrote to memory of 420	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	winlogon.exe
PID 3020 wrote to memory of 420	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	winlogon.exe
PID 3020 wrote to memory of 420	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	winlogon.exe
PID 3020 wrote to memory of 420	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	winlogon.exe
PID 3020 wrote to memory of 420	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	winlogon.exe
PID 3020 wrote to memory of 420	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	winlogon.exe
PID 3020 wrote to memory of 420	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	winlogon.exe
PID 3020 wrote to memory of 464	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	services.exe
PID 3020 wrote to memory of 464	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	services.exe
PID 3020 wrote to memory of 464	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	services.exe
PID 3020 wrote to memory of 464	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	services.exe
PID 3020 wrote to memory of 464	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	services.exe
PID 3020 wrote to memory of 464	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	services.exe
PID 3020 wrote to memory of 464	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	services.exe
PID 3020 wrote to memory of 480	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	lsass.exe
PID 3020 wrote to memory of 480	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	lsass.exe
PID 3020 wrote to memory of 480	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	lsass.exe
PID 3020 wrote to memory of 480	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	lsass.exe
PID 3020 wrote to memory of 480	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	lsass.exe
PID 3020 wrote to memory of 480	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	lsass.exe
PID 3020 wrote to memory of 480	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	lsass.exe
PID 3020 wrote to memory of 488	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	lsm.exe
PID 3020 wrote to memory of 488	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	lsm.exe
PID 3020 wrote to memory of 488	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	lsm.exe
PID 3020 wrote to memory of 488	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	lsm.exe
PID 3020 wrote to memory of 488	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	lsm.exe
PID 3020 wrote to memory of 488	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	lsm.exe
PID 3020 wrote to memory of 488	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	lsm.exe
PID 3020 wrote to memory of 588	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 588	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 588	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 588	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 588	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 588	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 588	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 668	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 668	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 668	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 668	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 668	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 668	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 668	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 756	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 756	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 756	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 756	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 756	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 756	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 756	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 808	3020	eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe	svchost.exe

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:464
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:588
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1908
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:668
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:756
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:808
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1336
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:844
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:988
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:300
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:276
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1028
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1236
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2896
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2980
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:480
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1412
- C:\Users\Admin\AppData\Local\Temp\eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\eb7c3ce5bf1ff3caa66c477d08d0ee26_JaffaCakes118.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-0-0x0000000000C80000-0x0000000000CF6000-memory.dmp

Filesize
472KB

Download
memory/3020-2-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-1-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-27-0x00000000005A0000-0x00000000005A8000-memory.dmp

Filesize
32KB

Download
memory/3020-28-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/3020-26-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-25-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-24-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-23-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-22-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-21-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-20-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-19-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-18-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-17-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-16-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-15-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-14-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-13-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-12-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-11-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-10-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-9-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-8-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-7-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-6-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-5-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-29-0x0000000000C80000-0x0000000000CF6000-memory.dmp

Filesize
472KB

Download
memory/3020-4-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3020-3-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads