xtremerat | 0b9ae5b5e11e103e80c80e90d2aa3105accf8babbc1525a39def89105bc4092d

General

Target
a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
Size 661KB
Sample240613-s5tlhsvdnc
SHA256 0b9ae5b5e11e103e80c80e90d2aa3105accf8babbc1525a39def89105bc4092d
MD5 a6506a40d522a744be02abe57dd40864
SHA1 35eb03893099f7f97fd08ecb0bf48f5d73f05c24
SHA512 373b97614840dd795dcd09ac7967a2d2b78379a53cdc96da71c6f489ec79b24eabc9b1ecdddbe5251d829da01959c9fc665d30cb5a0b757c50edbaa144fd64b4
SSDEEP 6144:1XFjjxnIgK54IQzeeeL4/QPnIgK54IQzeeeL4/Q9711j:11j9IgKKM4YPIgKKM4Yl1t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

C2

oudy.no-ip.biz

Signatures

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/3108-2-0x0000000000C80000-0x0000000000D2D000-memory.dmp	family_xtremerat
behavioral2/memory/3488-7-0x0000000000C80000-0x0000000000D2D000-memory.dmp	family_xtremerat
behavioral2/files/0x000700000002325a-8.dat	family_xtremerat
behavioral2/memory/208-9-0x0000000000C80000-0x0000000000D2D000-memory.dmp	family_xtremerat
behavioral2/memory/208-13-0x0000000000C80000-0x0000000000D2D000-memory.dmp	family_xtremerat
behavioral2/memory/3108-14-0x0000000000C80000-0x0000000000D2D000-memory.dmp	family_xtremerat

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\WIN 7\\HACKO.exe"	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\WIN 7\\HACKO.exe"	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\WIN 7\\HACKO.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\WIN 7\\HACKO.exe"	svchost.exe

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Adds policy Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\svchost = "C:\\Windows\\WIN 7\\HACKO.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\svchost = "C:\\Windows\\WIN 7\\HACKO.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\svchost = "C:\\Windows\\WIN 7\\HACKO.exe"	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\svchost = "C:\\Windows\\WIN 7\\HACKO.exe"	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{011QR532-6C0B-5437-85X3-F4SBETW55W46}	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{011QR532-6C0B-5437-85X3-F4SBETW55W46}\StubPath = "C:\\Windows\\WIN 7\\HACKO.exe restart"	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{011QR532-6C0B-5437-85X3-F4SBETW55W46}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{011QR532-6C0B-5437-85X3-F4SBETW55W46}\StubPath = "C:\\Windows\\WIN 7\\HACKO.exe restart"	svchost.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\svchost = "C:\\Windows\\WIN 7\\HACKO.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\WIN 7\\HACKO.exe"	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\WIN 7\\HACKO.exe"	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\svchost = "C:\\Windows\\WIN 7\\HACKO.exe"	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\svchost = "C:\\Windows\\WIN 7\\HACKO.exe"	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\WIN 7\\HACKO.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\WIN 7\\HACKO.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\svchost = "C:\\Windows\\WIN 7\\HACKO.exe"	svchost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WIN 7\HACKO.exe	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
File created	C:\Windows\WIN 7\HACKO.exe	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
File opened for modification	C:\Windows\WIN 7\	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
208	svchost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 3488	3108	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe	92
PID 3108 wrote to memory of 3488	3108	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe	92
PID 3108 wrote to memory of 3488	3108	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe	92
PID 3108 wrote to memory of 3488	3108	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe	92
PID 3108 wrote to memory of 1956	3108	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe	93
PID 3108 wrote to memory of 1956	3108	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe	93
PID 3108 wrote to memory of 1956	3108	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe	93
PID 3108 wrote to memory of 4108	3108	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe	94
PID 3108 wrote to memory of 4108	3108	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe	94
PID 3108 wrote to memory of 4108	3108	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe	94
PID 3108 wrote to memory of 208	3108	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe	95
PID 3108 wrote to memory of 208	3108	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe	95
PID 3108 wrote to memory of 208	3108	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe	95
PID 3108 wrote to memory of 208	3108	a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a6506a40d522a744be02abe57dd40864_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Modifies WinLogon for persistence
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  PID:3488
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1956
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:4108
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5248 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4

T1547

Registry Run Keys / Startup Folder

3

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

4

T1547

Registry Run Keys / Startup Folder

3

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HACKO.exe

Path C:\Windows\WIN 7\HACKO.exe
Size 661KB
SHA256 0b9ae5b5e11e103e80c80e90d2aa3105accf8babbc1525a39def89105bc4092d
MD5 a6506a40d522a744be02abe57dd40864
SHA1 35eb03893099f7f97fd08ecb0bf48f5d73f05c24
SHA512 373b97614840dd795dcd09ac7967a2d2b78379a53cdc96da71c6f489ec79b24eabc9b1ecdddbe5251d829da01959c9fc665d30cb5a0b757c50edbaa144fd64b4
SSDEEP 6144:1XFjjxnIgK54IQzeeeL4/QPnIgK54IQzeeeL4/Q9711j:11j9IgKKM4YPIgKKM4Yl1t
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-9-0x0000000000C80000-0x0000000000D2D000-memory.dmp

Download

memory/208-13-0x0000000000C80000-0x0000000000D2D000-memory.dmp

Download

memory/3108-2-0x0000000000C80000-0x0000000000D2D000-memory.dmp

Download

memory/3108-14-0x0000000000C80000-0x0000000000D2D000-memory.dmp

Download

memory/3488-7-0x0000000000C80000-0x0000000000D2D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads