xtremerat | f7e19d70e0f46d87c813bd371e752261436437d721dc9a99fb81c39420621c8d

General

Target

efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe
Size

62KB
MD5

efaf9583f501557601f7acc59d1a7d32
SHA1

462da960c5f411ff2002cc2d68b9876ed0358b29
SHA256

f7e19d70e0f46d87c813bd371e752261436437d721dc9a99fb81c39420621c8d
SHA512

523de41e53d09448bdaf5a108de13269b00c79485fbcb449c4d265a8124c9b735fa13e4e972020385d291ede43f76a3d5845719462fe1312dee1b42da5d67526
SSDEEP

1536:hNW71rcYDAWeotvXliBghB29g4p9GDRlzch9QBUiAESG6m:hNW7dEvotvXmgj264zaQQB

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

C2

klawchi.no-ip.org

Signatures

Detect XtremeRAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1040-0-0x0000000010000000-0x0000000010054000-memory.dmp	family_xtremerat
behavioral1/memory/1856-3-0x0000000010000000-0x0000000010054000-memory.dmp	family_xtremerat
behavioral1/memory/1040-8-0x0000000010000000-0x0000000010054000-memory.dmp	family_xtremerat
behavioral1/memory/1856-11-0x0000000010000000-0x0000000010054000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1040-0-0x0000000010000000-0x0000000010054000-memory.dmp	upx
behavioral1/memory/1856-3-0x0000000010000000-0x0000000010054000-memory.dmp	upx
behavioral1/memory/1040-8-0x0000000010000000-0x0000000010054000-memory.dmp	upx
behavioral1/memory/1856-11-0x0000000010000000-0x0000000010054000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

Processes:

efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exeDllHost.exe

description	ioc	process
File created	C:\Windows\28ياااااااروحي يازاحف.jpg.exe	efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe
File created	C:\Windows\28ياااااااروحي يازاحف.jpg	efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe
File opened for modification	C:\Windows\28ياااااااروحي يازاحف.jpg	DllHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

2472 DllHost.exe

pid	process
2472	DllHost.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe

description	pid	process	target process
PID 1040 wrote to memory of 1856	1040	efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe	svchost.exe
PID 1040 wrote to memory of 1856	1040	efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe	svchost.exe
PID 1040 wrote to memory of 1856	1040	efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe	svchost.exe
PID 1040 wrote to memory of 1856	1040	efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe	svchost.exe
PID 1040 wrote to memory of 1856	1040	efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe	svchost.exe
PID 1040 wrote to memory of 2456	1040	efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe	iexplore.exe
PID 1040 wrote to memory of 2456	1040	efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe	iexplore.exe
PID 1040 wrote to memory of 2456	1040	efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe	iexplore.exe
PID 1040 wrote to memory of 2456	1040	efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe	iexplore.exe
PID 1040 wrote to memory of 2456	1040	efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\efaf9583f501557601f7acc59d1a7d32_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:1856

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
2⤵
PID:2456

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:2472

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\28ياااااااروحي يازاحف.jpg
Filesize
24KB

MD5
ade68706d385407347c7f6c56f6c65f7

SHA1
b2b63ae0ed8c71e893faf8edb2bcf308895b8e48

SHA256
de6602491e417887f67c87b5df7b78fe5120d12d88ce8293f9a0a41315768afa

SHA512
5e509722d57dcdb321016ae9642a4f3640e57bdaaa1e0246c229d836844637a0c85aa0ea69f3122d1b93384d7ef010f2604869e6e81a27723dbc85f6af31e42c

Download Submit
memory/1040-0-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/1040-6-0x0000000002CC0000-0x0000000002CC2000-memory.dmp

Filesize
8KB

Download
memory/1040-8-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/1856-1-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/1856-3-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/1856-11-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/2472-7-0x0000000000280000-0x0000000000282000-memory.dmp

Filesize
8KB

Download
memory/2472-9-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download
memory/2472-12-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads