xtremerat | f2ac1d0feeaeff5ee3569cbfade56f8287b8f7febbb1fe88a117ec86336ee317

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab53c99262a904d3288354430774254a_JaffaCakes118.exe
Size

89KB
MD5

ab53c99262a904d3288354430774254a
SHA1

7d7d9c71733ed56d3a1902671a0828132d295827
SHA256

f2ac1d0feeaeff5ee3569cbfade56f8287b8f7febbb1fe88a117ec86336ee317
SHA512

5a1b7cd678a04e56e13776a6bc2039894231440bf54529a310288e5584fc26fcd7c4448a8a4649b113e8bb491b8929739c61a21da9227cf58cd11d9fd966e227
SSDEEP

1536:hfteRCzl2x7/Gh3ZdW4J8q06mul+BLemg5Tf9u8N:ttR2B/Gh3tJhlEDgZfYW

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3068-6-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral1/memory/3068-11-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral1/memory/3068-8-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral1/memory/3068-7-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral1/memory/3068-5-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral1/memory/3068-4-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

ab53c99262a904d3288354430774254a_JaffaCakes118.exe

description	pid	process	target process
PID 2988 set thread context of 3068	2988	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ab53c99262a904d3288354430774254a_JaffaCakes118.exe

description	pid	process	target process
PID 2988 wrote to memory of 3068	2988	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2988 wrote to memory of 3068	2988	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2988 wrote to memory of 3068	2988	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2988 wrote to memory of 3068	2988	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2988 wrote to memory of 3068	2988	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2988 wrote to memory of 3068	2988	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2988 wrote to memory of 3068	2988	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2988 wrote to memory of 3068	2988	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2988 wrote to memory of 3068	2988	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2988 wrote to memory of 3068	2988	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2988 wrote to memory of 3068	2988	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2988 wrote to memory of 3068	2988	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ab53c99262a904d3288354430774254a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ab53c99262a904d3288354430774254a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\ab53c99262a904d3288354430774254a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ab53c99262a904d3288354430774254a_JaffaCakes118.exe
  2⤵
  PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-0-0x0000000074071000-0x0000000074072000-memory.dmp

Filesize
4KB

Download
memory/2988-1-0x0000000074070000-0x000000007461B000-memory.dmp

Filesize
5.7MB

Download
memory/2988-13-0x0000000074070000-0x000000007461B000-memory.dmp

Filesize
5.7MB

Download
memory/2988-12-0x0000000074070000-0x000000007461B000-memory.dmp

Filesize
5.7MB

Download
memory/3068-7-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3068-8-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3068-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3068-5-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3068-4-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3068-3-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3068-2-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3068-11-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3068-6-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download