xtremerat | 02d354106d7d5e9cdd2a2563a2a5ca18f70b4d794895c9f211534947928d76f2

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 09:58

Target

f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe
Size

65KB
MD5

f33f074565f7439f47eeb8429cc4be4b
SHA1

e1059ffe3d41ea866e47514a37d3c966a73a6917
SHA256

02d354106d7d5e9cdd2a2563a2a5ca18f70b4d794895c9f211534947928d76f2
SHA512

9ba90c8322df63f4e88c96845ed9662277ceaa1c585ab944e319902b401960ce1d8548ddab8ec739d5f234fbcc55c73ef819aa986e472433eca8cf4f6f9d27e3
SSDEEP

768:Q3m1SqRNQNLBGH1Dcz0wDeeQuMVTyN8ihHo37Vmd6AeXVtWAW7A+7yoNwf/Kcw:PsqfQIGZQuIyJh0mgA+FW0gNw6

Score

10^/10

Family

xtremerat

a323.no-ip.biz

Detect XtremeRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2956-2-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral1/memory/2044-3-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral1/memory/2956-4-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe

description	pid	process	target process
PID 2044 wrote to memory of 2956	2044	f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe	svchost.exe
PID 2044 wrote to memory of 2956	2044	f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe	svchost.exe
PID 2044 wrote to memory of 2956	2044	f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe	svchost.exe
PID 2044 wrote to memory of 2956	2044	f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe	svchost.exe
PID 2044 wrote to memory of 2956	2044	f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe	svchost.exe
PID 2044 wrote to memory of 3024	2044	f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe	iexplore.exe
PID 2044 wrote to memory of 3024	2044	f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe	iexplore.exe
PID 2044 wrote to memory of 3024	2044	f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe	iexplore.exe
PID 2044 wrote to memory of 3024	2044	f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe	iexplore.exe
PID 2044 wrote to memory of 3024	2044	f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2956
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:3024

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2044-3-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/2956-0-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/2956-2-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/2956-4-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download