xtremerat | 17ae48c218dd0bf7f88e6e5e25c5bb9c62c110f01606d8b4ea15f0a1ee8e4a1d

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 10:46

Target

fc94c90a12d23390443d2822f40dc38c_JaffaCakes118.exe
Size

85KB
MD5

fc94c90a12d23390443d2822f40dc38c
SHA1

5a401e38129d2ade1823b381e3c1910ef00ded2d
SHA256

17ae48c218dd0bf7f88e6e5e25c5bb9c62c110f01606d8b4ea15f0a1ee8e4a1d
SHA512

b8dd8fbd82384915db8442aca8ee5c907f4c9dc7dd1ff97cfe7f8ece4e5a16f68b38cba93cc9524f6ed93180aae3c3f37b4f2525e83733477e4b3f3b7fe1f165
SSDEEP

768:Ym1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGiZKPA+7XoNL:7sq+QV4rObAdXWpf/y+7ozNwiGfEftog

Score

10^/10

Detect XtremeRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2156-0-0x0000000010000000-0x000000001004F000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2816 2156 WerFault.exe fc94c90a12d23390443d2822f40dc38c_JaffaCakes118.exe

pid	pid_target	process	target process
2816	2156	WerFault.exe	fc94c90a12d23390443d2822f40dc38c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fc94c90a12d23390443d2822f40dc38c_JaffaCakes118.exe

description	pid	process	target process
PID 2156 wrote to memory of 2816	2156	fc94c90a12d23390443d2822f40dc38c_JaffaCakes118.exe	WerFault.exe
PID 2156 wrote to memory of 2816	2156	fc94c90a12d23390443d2822f40dc38c_JaffaCakes118.exe	WerFault.exe
PID 2156 wrote to memory of 2816	2156	fc94c90a12d23390443d2822f40dc38c_JaffaCakes118.exe	WerFault.exe
PID 2156 wrote to memory of 2816	2156	fc94c90a12d23390443d2822f40dc38c_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fc94c90a12d23390443d2822f40dc38c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc94c90a12d23390443d2822f40dc38c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 160
2⤵
- Program crash
PID:2816

memory/2156-0-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download