xtremerat | 436220d400ab472053908e68a15ad49a95fda8b27099d94478a87267db849080

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/06/2024, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
003d671eb5555c956d2862b08d04f29b_JaffaCakes118.exe
Size 417KB
Sample240621-3pht7azdpq
SHA256 436220d400ab472053908e68a15ad49a95fda8b27099d94478a87267db849080
MD5 003d671eb5555c956d2862b08d04f29b
SHA1 4a0de8286cd02c50b45aea08a429b9ba8c31ffdf
SHA512 ef60d59929948c312e11a26b17ad0b9a3dd4edd57645aabdb4e7629dd224f598ffd905ec0e9cab8c180bf10399716a0eac5678b639c5f50ad9304475171c31e4
SSDEEP 6144:41db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe59kL+QuI8s0e+yb:4jkArEN249AyE/rbaMct4bO2/VkWI8mr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

fsonsuzadek1980.no-ip.biz

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1392-8-0x0000000010000000-0x000000001004B000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Executes dropped EXE 1 IoCs

pid	Process
1392	Sdat.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1352-0-0x0000000000400000-0x00000000004B9000-memory.dmp	upx
behavioral2/files/0x000d00000002342e-3.dat	upx
behavioral2/memory/1392-5-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral2/memory/1352-7-0x0000000000400000-0x00000000004B9000-memory.dmp	upx
behavioral2/memory/1392-8-0x0000000010000000-0x000000001004B000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/1352-7-0x0000000000400000-0x00000000004B9000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1392	1352	003d671eb5555c956d2862b08d04f29b_JaffaCakes118.exe	81
PID 1352 wrote to memory of 1392	1352	003d671eb5555c956d2862b08d04f29b_JaffaCakes118.exe	81
PID 1352 wrote to memory of 1392	1352	003d671eb5555c956d2862b08d04f29b_JaffaCakes118.exe	81
PID 1392 wrote to memory of 4892	1392	Sdat.exe	82
PID 1392 wrote to memory of 4892	1392	Sdat.exe	82
PID 1392 wrote to memory of 4892	1392	Sdat.exe	82

C:\Users\Admin\AppData\Local\Temp\003d671eb5555c956d2862b08d04f29b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\003d671eb5555c956d2862b08d04f29b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Users\Admin\AppData\Roaming\Sdat.exe
  C:\Users\Admin\AppData\Roaming\Sdat.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Sdat.exe

Path C:\Users\Admin\AppData\Roaming\Sdat.exe
Size 31KB
SHA256 2c3e88d7a7e1db517ef35315b2b71b82ac06e3914de33cf8fe13ec163a441a4d
MD5 dee0fc9bcc6d347bec86c7a7a670782a
SHA1 d7bfa1b819f556b2e99c5729cd07b9d5aaa30fdd
SHA512 002ca623295b53278eb02fd3abeb50fc6cd5cd5e590fe32d13440f253012225e09c45ad6abfde723ebb2b1df18dcd7aa2937f7d5acef59fe2c65f60fe62b741f
SSDEEP 768:isuijtHf5g7/MjN3Ha4LWqY+5cpSMuRRRzv4/+5jj6S9VLDTSbK:/NW70x6ALBwrELPSbK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1352-0-0x0000000000400000-0x00000000004B9000-memory.dmp

Download

memory/1352-7-0x0000000000400000-0x00000000004B9000-memory.dmp

Download

memory/1392-5-0x0000000010000000-0x000000001004B000-memory.dmp

Download

memory/1392-8-0x0000000010000000-0x000000001004B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads