xtremerat | 02d354106d7d5e9cdd2a2563a2a5ca18f70b4d794895c9f211534947928d76f2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 09:58

Target

f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe
Size

65KB
MD5

f33f074565f7439f47eeb8429cc4be4b
SHA1

e1059ffe3d41ea866e47514a37d3c966a73a6917
SHA256

02d354106d7d5e9cdd2a2563a2a5ca18f70b4d794895c9f211534947928d76f2
SHA512

9ba90c8322df63f4e88c96845ed9662277ceaa1c585ab944e319902b401960ce1d8548ddab8ec739d5f234fbcc55c73ef819aa986e472433eca8cf4f6f9d27e3
SSDEEP

768:Q3m1SqRNQNLBGH1Dcz0wDeeQuMVTyN8ihHo37Vmd6AeXVtWAW7A+7yoNwf/Kcw:PsqfQIGZQuIyJh0mgA+FW0gNw6

Score

10^/10

Detect XtremeRAT payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4424-0-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/4424-1-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/4424-2-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/4424-3-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/4424-4-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/4424-8-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f33f074565f7439f47eeb8429cc4be4b_JaffaCakes118.exe"
1⤵
PID:4424

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4424-0-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/4424-1-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/4424-2-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/4424-3-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/4424-4-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/4424-8-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download