xtremerat | 878c8c333e1ed1a1df557691b30b4a0e24c3f1d8b00518c96eb57f77d9fd5f7b

General

Target
03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe
Size 89KB
Sample240620-hedghaydpr
SHA256 878c8c333e1ed1a1df557691b30b4a0e24c3f1d8b00518c96eb57f77d9fd5f7b
MD5 03b3a46d46653b02a847cdd9f60d06c4
SHA1 2ab5f93cf64b13c0ada36df2cc1e5f51158e33c6
SHA512 036fe772e826211a4dbfd48ea3858cd8c8571890f341e3a22c3a2d9ec45ba066db11be7b709bdc35cb6831289ae230fb9a905e02440fe803bfebd6e06d73226e
SSDEEP 1536:ebIoy+0U1Jg2japh1gOrsU3e0zuPhM8E33G4gC6TBmsMuNsN5ZO0fJ0x0GJd:eS9K+xD1xne0zG7MObgXZ50
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/4448-13-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/4448-19-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/4448-20-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/4448-18-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/4448-16-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/4448-14-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1324-4-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1324-9-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1324-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1324-24-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2540 set thread context of 1324	2540	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	85
PID 1324 set thread context of 4448	1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3440	4448	WerFault.exe	87

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2540	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe
1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1324	2540	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	85
PID 2540 wrote to memory of 1324	2540	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	85
PID 2540 wrote to memory of 1324	2540	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	85
PID 2540 wrote to memory of 1324	2540	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	85
PID 2540 wrote to memory of 1324	2540	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	85
PID 2540 wrote to memory of 1324	2540	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	85
PID 2540 wrote to memory of 1324	2540	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	85
PID 2540 wrote to memory of 1324	2540	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	85
PID 1324 wrote to memory of 4448	1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	87
PID 1324 wrote to memory of 4448	1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	87
PID 1324 wrote to memory of 4448	1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	87
PID 1324 wrote to memory of 4448	1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	87
PID 1324 wrote to memory of 4448	1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	87
PID 1324 wrote to memory of 4448	1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	87
PID 1324 wrote to memory of 4448	1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	87
PID 1324 wrote to memory of 4448	1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	87
PID 1324 wrote to memory of 4448	1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	87
PID 1324 wrote to memory of 4448	1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	87
PID 1324 wrote to memory of 4448	1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	87
PID 1324 wrote to memory of 4448	1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	87
PID 1324 wrote to memory of 4448	1324	03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Local\Temp\03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe"
  2⤵
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Users\Admin\AppData\Local\Temp\03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\03b3a46d46653b02a847cdd9f60d06c4_JaffaCakes118.exe"
    3⤵
    PID:4448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 12
      4⤵
      Program crash
      PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4448 -ip 4448
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1324-24-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1324-4-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1324-9-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1324-10-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2540-3-0x0000000000402000-0x0000000000403000-memory.dmp

Download

memory/2540-6-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/2540-0-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4448-13-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

memory/4448-20-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

memory/4448-18-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

memory/4448-16-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

memory/4448-14-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

memory/4448-19-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads