xtremerat | 73714b15beafd757fa25477892eb5113fa875b27b78d9d8d1740a09beea66881

General

Target

f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe
Size

149KB
MD5

f98d60bc75e136c0c30d568f1b72fda1
SHA1

f5142c523bafa804df62052061bce28cae52888d
SHA256

73714b15beafd757fa25477892eb5113fa875b27b78d9d8d1740a09beea66881
SHA512

dc205cf8a5f4b67cd0164e1ae13209b8d8c15f320c7d67c26feb43cbe6d3dbee6d3a5fa66652a0cc21084ed6aa175a8b18bf5017d82a0bd7cfc1ea307327ed31
SSDEEP

3072:kcLBFytaT80yMl8I8YPhiogPt5sHTee/Xmu0ThMBhSUQBgsv:kGytGByk8gPhzSIY7+sv

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

C2

dannymatrix.no-ip.org

Signatures

Detect XtremeRAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2004-13-0x0000000010000000-0x000000001004F000-memory.dmp	family_xtremerat
behavioral1/memory/2792-16-0x0000000010000000-0x000000001004F000-memory.dmp	family_xtremerat
behavioral1/memory/2004-21-0x0000000010000000-0x000000001004F000-memory.dmp	family_xtremerat
behavioral1/memory/2792-24-0x0000000010000000-0x000000001004F000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2004-5-0x0000000010000000-0x000000001004F000-memory.dmp	upx
behavioral1/memory/2004-6-0x0000000010000000-0x000000001004F000-memory.dmp	upx
behavioral1/memory/2004-9-0x0000000010000000-0x000000001004F000-memory.dmp	upx
behavioral1/memory/2004-12-0x0000000010000000-0x000000001004F000-memory.dmp	upx
behavioral1/memory/2004-13-0x0000000010000000-0x000000001004F000-memory.dmp	upx
behavioral1/memory/2792-16-0x0000000010000000-0x000000001004F000-memory.dmp	upx
behavioral1/memory/2004-21-0x0000000010000000-0x000000001004F000-memory.dmp	upx
behavioral1/memory/2792-24-0x0000000010000000-0x000000001004F000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

Processes:

f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exeDllHost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\301images.jpg.exe	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\301images.jpg	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\301images.jpg	DllHost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe

description	pid	process	target process
PID 2860 set thread context of 2004	2860	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

2396 DllHost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe

pid process

2860 f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe

pid	process
2396	DllHost.exe

pid	process
2860	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exef98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe

description	pid	process	target process
PID 2860 wrote to memory of 2004	2860	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe
PID 2860 wrote to memory of 2004	2860	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe
PID 2860 wrote to memory of 2004	2860	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe
PID 2860 wrote to memory of 2004	2860	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe
PID 2860 wrote to memory of 2004	2860	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe
PID 2860 wrote to memory of 2004	2860	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe
PID 2860 wrote to memory of 2004	2860	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe
PID 2860 wrote to memory of 2004	2860	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe
PID 2004 wrote to memory of 2792	2004	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	svchost.exe
PID 2004 wrote to memory of 2792	2004	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	svchost.exe
PID 2004 wrote to memory of 2792	2004	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	svchost.exe
PID 2004 wrote to memory of 2792	2004	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	svchost.exe
PID 2004 wrote to memory of 2792	2004	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	svchost.exe
PID 2004 wrote to memory of 2624	2004	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	iexplore.exe
PID 2004 wrote to memory of 2624	2004	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	iexplore.exe
PID 2004 wrote to memory of 2624	2004	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	iexplore.exe
PID 2004 wrote to memory of 2624	2004	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	iexplore.exe
PID 2004 wrote to memory of 2624	2004	f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860

C:\Users\Admin\AppData\Local\Temp\f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f98d60bc75e136c0c30d568f1b72fda1_JaffaCakes118.exe"
2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
PID:2792

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:2624

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:2396

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\301images.jpg
Filesize
5KB

MD5
41cad96ba4f1bcb3159b47bd450f3089

SHA1
1e4cd4b729ff1a0466043987a7b5de7850c9cb6c

SHA256
da663ec6d945bd81289ce5737fb08bc496a6614eb1684249f75b38b337103545

SHA512
3d339f7075d076de8d6bc5483548455ae5b6b9d37c580f93a400eff1b2215e0394a03e08f4b54c3e3929732a1ba53911693f6a6da1a90e34aa0b36d5a609cda0

Download Submit
memory/2004-13-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download
memory/2004-6-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download
memory/2004-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2004-12-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download
memory/2004-5-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download
memory/2004-4-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download
memory/2004-9-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download
memory/2004-19-0x0000000002790000-0x0000000002792000-memory.dmp

Filesize
8KB

Download
memory/2004-21-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download
memory/2396-22-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2396-25-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2396-20-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download
memory/2792-16-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download
memory/2792-24-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download
memory/2860-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2860-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads