xtremerat | 2aad03178c7e90f6c6d0264d57ea0981c26ff4713a2bb006cbee4b19ecb360f5

General

Target
1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe
Size 148KB
Sample240628-ba7ffssbne
SHA256 2aad03178c7e90f6c6d0264d57ea0981c26ff4713a2bb006cbee4b19ecb360f5
MD5 1833558ee042699c879b6ac9ee02c3e2
SHA1 a1d52cf46e587198b7c164b1663cd7bf24d2b5ef
SHA512 b21e7cc7858ad967b8a70e580645878d4deb441f2e805123c370622bcfa009d273fc891e5e472bd4c18a130af136538b6ca576fdee92bc0b90c51ffbe8a3dfdf
SSDEEP 3072:fJc4j4tMBfm1bUiTrZyZmTWF42wDThZgf6ndVs:6F2YGFwHhyf6nI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

C2

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/3644-6-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/3644-5-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1956-13-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/912-14-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/3644-16-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/912-18-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Active Setup

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{8251KKI0-580G-8M1S-0C3X-OU6I3535W01X}	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8251KKI0-580G-8M1S-0C3X-OU6I3535W01X}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\Server.exe restart"	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3644-2-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/3644-4-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/3644-6-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/3644-5-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1956-13-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/912-14-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/3644-16-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/912-18-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\Server.exe"	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\Server.exe"	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1408 set thread context of 3644	1408	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1200	1956	WerFault.exe	82

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1408	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe
912	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 3644	1408	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	81
PID 1408 wrote to memory of 3644	1408	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	81
PID 1408 wrote to memory of 3644	1408	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	81
PID 1408 wrote to memory of 3644	1408	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	81
PID 1408 wrote to memory of 3644	1408	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	81
PID 1408 wrote to memory of 3644	1408	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	81
PID 1408 wrote to memory of 3644	1408	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	81
PID 1408 wrote to memory of 3644	1408	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	81
PID 3644 wrote to memory of 1956	3644	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	82
PID 3644 wrote to memory of 1956	3644	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	82
PID 3644 wrote to memory of 1956	3644	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	82
PID 3644 wrote to memory of 1956	3644	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	82
PID 3644 wrote to memory of 912	3644	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	83
PID 3644 wrote to memory of 912	3644	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	83
PID 3644 wrote to memory of 912	3644	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	83
PID 3644 wrote to memory of 912	3644	1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118.exe	83