xtremerat | f2ac1d0feeaeff5ee3569cbfade56f8287b8f7febbb1fe88a117ec86336ee317

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ab53c99262a904d3288354430774254a_JaffaCakes118.exe
Size 89KB
Sample240614-zagf2aydll
SHA256 f2ac1d0feeaeff5ee3569cbfade56f8287b8f7febbb1fe88a117ec86336ee317
MD5 ab53c99262a904d3288354430774254a
SHA1 7d7d9c71733ed56d3a1902671a0828132d295827
SHA512 5a1b7cd678a04e56e13776a6bc2039894231440bf54529a310288e5584fc26fcd7c4448a8a4649b113e8bb491b8929739c61a21da9227cf58cd11d9fd966e227
SSDEEP 1536:hfteRCzl2x7/Gh3ZdW4J8q06mul+BLemg5Tf9u8N:ttR2B/Gh3tJhlEDgZfYW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1572-3-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2928 set thread context of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4864	1572	WerFault.exe	84

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1572	ab53c99262a904d3288354430774254a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	84
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	84
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	84
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	84
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	84
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	84
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	84
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	84
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	84
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	84
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	84
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	84
PID 2928 wrote to memory of 1572	2928	ab53c99262a904d3288354430774254a_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\ab53c99262a904d3288354430774254a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ab53c99262a904d3288354430774254a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\ab53c99262a904d3288354430774254a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ab53c99262a904d3288354430774254a_JaffaCakes118.exe
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 12
    3⤵
    - Program crash
    PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1572 -ip 1572
1⤵
PID:4780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-3-0x0000000010000000-0x0000000010048000-memory.dmp

Download

memory/2928-0-0x0000000074A42000-0x0000000074A43000-memory.dmp

Download

memory/2928-1-0x0000000074A40000-0x0000000074FF1000-memory.dmp

Download

memory/2928-2-0x0000000074A40000-0x0000000074FF1000-memory.dmp

Download

memory/2928-5-0x0000000074A40000-0x0000000074FF1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads