xtremerat | f2ac1d0feeaeff5ee3569cbfade56f8287b8f7febbb1fe88a117ec86336ee317

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab53c99262a904d3288354430774254a_JaffaCakes118.exe
Size

89KB
MD5

ab53c99262a904d3288354430774254a
SHA1

7d7d9c71733ed56d3a1902671a0828132d295827
SHA256

f2ac1d0feeaeff5ee3569cbfade56f8287b8f7febbb1fe88a117ec86336ee317
SHA512

5a1b7cd678a04e56e13776a6bc2039894231440bf54529a310288e5584fc26fcd7c4448a8a4649b113e8bb491b8929739c61a21da9227cf58cd11d9fd966e227
SSDEEP

1536:hfteRCzl2x7/Gh3ZdW4J8q06mul+BLemg5Tf9u8N:ttR2B/Gh3tJhlEDgZfYW

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1572-3-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

ab53c99262a904d3288354430774254a_JaffaCakes118.exe

description	pid	process	target process
PID 2928 set thread context of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4864 1572 WerFault.exe ab53c99262a904d3288354430774254a_JaffaCakes118.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

ab53c99262a904d3288354430774254a_JaffaCakes118.exe

pid process

1572 ab53c99262a904d3288354430774254a_JaffaCakes118.exe

pid	pid_target	process	target process
4864	1572	WerFault.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe

pid	process
1572	ab53c99262a904d3288354430774254a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

ab53c99262a904d3288354430774254a_JaffaCakes118.exe

description	pid	process	target process
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	ab53c99262a904d3288354430774254a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ab53c99262a904d3288354430774254a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ab53c99262a904d3288354430774254a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\ab53c99262a904d3288354430774254a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ab53c99262a904d3288354430774254a_JaffaCakes118.exe
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 12
    3⤵
    - Program crash
    PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1572 -ip 1572
1⤵
PID:4780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-3-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/2928-0-0x0000000074A42000-0x0000000074A43000-memory.dmp

Filesize
4KB

Download
memory/2928-1-0x0000000074A40000-0x0000000074FF1000-memory.dmp

Filesize
5.7MB

Download
memory/2928-2-0x0000000074A40000-0x0000000074FF1000-memory.dmp

Filesize
5.7MB

Download
memory/2928-5-0x0000000074A40000-0x0000000074FF1000-memory.dmp

Filesize
5.7MB

Download