xtremerat | e6123e02a34b7b2668832cdd15c5945f7ec2825003865f0d09d98152f2be1a1d

Analysis

max time kernel
140s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

756cb353f3bb83dd2317950dc0b0fb23_JaffaCakes118.exe
Size

65KB
MD5

756cb353f3bb83dd2317950dc0b0fb23
SHA1

39d60b97cf045e9462921fb63248f6d0bddb8b7f
SHA256

e6123e02a34b7b2668832cdd15c5945f7ec2825003865f0d09d98152f2be1a1d
SHA512

d0d9ab55b2e5b06f098867b1d2883ce78b9d18d46a0289450d6252676ebd150226880dc84137793e93373af146462d420534d52643bd7914431111204fb9a076
SSDEEP

768:88m1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGiXsbs8HOzJ:esq+QV4rObAdXWpf/y+YaSom

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

mesn.no-ip.biz

Signatures

Detect XtremeRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2632-0-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2260-1-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2632-2-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

464 2632 WerFault.exe svchost.exe
2180 2632 WerFault.exe svchost.exe

pid	pid_target	process	target process
464	2632	WerFault.exe	svchost.exe
2180	2632	WerFault.exe	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

756cb353f3bb83dd2317950dc0b0fb23_JaffaCakes118.exe

description	pid	process	target process
PID 2260 wrote to memory of 2632	2260	756cb353f3bb83dd2317950dc0b0fb23_JaffaCakes118.exe	svchost.exe
PID 2260 wrote to memory of 2632	2260	756cb353f3bb83dd2317950dc0b0fb23_JaffaCakes118.exe	svchost.exe
PID 2260 wrote to memory of 2632	2260	756cb353f3bb83dd2317950dc0b0fb23_JaffaCakes118.exe	svchost.exe
PID 2260 wrote to memory of 2632	2260	756cb353f3bb83dd2317950dc0b0fb23_JaffaCakes118.exe	svchost.exe
PID 2260 wrote to memory of 1576	2260	756cb353f3bb83dd2317950dc0b0fb23_JaffaCakes118.exe	msedge.exe
PID 2260 wrote to memory of 1576	2260	756cb353f3bb83dd2317950dc0b0fb23_JaffaCakes118.exe	msedge.exe
PID 2260 wrote to memory of 1576	2260	756cb353f3bb83dd2317950dc0b0fb23_JaffaCakes118.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\756cb353f3bb83dd2317950dc0b0fb23_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\756cb353f3bb83dd2317950dc0b0fb23_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 488
    3⤵
    - Program crash
    PID:464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 496
    3⤵
    - Program crash
    PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2632 -ip 2632
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2632 -ip 2632
1⤵
PID:908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-1-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2632-0-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2632-2-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download