xtremerat | 17ae48c218dd0bf7f88e6e5e25c5bb9c62c110f01606d8b4ea15f0a1ee8e4a1d

Analysis

max time kernel
141s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 10:46

Target

fc94c90a12d23390443d2822f40dc38c_JaffaCakes118.exe
Size

85KB
MD5

fc94c90a12d23390443d2822f40dc38c
SHA1

5a401e38129d2ade1823b381e3c1910ef00ded2d
SHA256

17ae48c218dd0bf7f88e6e5e25c5bb9c62c110f01606d8b4ea15f0a1ee8e4a1d
SHA512

b8dd8fbd82384915db8442aca8ee5c907f4c9dc7dd1ff97cfe7f8ece4e5a16f68b38cba93cc9524f6ed93180aae3c3f37b4f2525e83733477e4b3f3b7fe1f165
SSDEEP

768:Ym1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGiZKPA+7XoNL:7sq+QV4rObAdXWpf/y+7ozNwiGfEftog

Score

10^/10

Detect XtremeRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2260-0-0x0000000010000000-0x000000001004F000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2584 2260 WerFault.exe fc94c90a12d23390443d2822f40dc38c_JaffaCakes118.exe

pid	pid_target	process	target process
2584	2260	WerFault.exe	fc94c90a12d23390443d2822f40dc38c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc94c90a12d23390443d2822f40dc38c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc94c90a12d23390443d2822f40dc38c_JaffaCakes118.exe"
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 500
2⤵
- Program crash
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2260 -ip 2260
1⤵
PID:2876

memory/2260-0-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download