xtremerat | e6f8559599f741c5c51425d32fe66103d669985ef697a4d3ad47066762cf3c2d

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe
Size 588KB
Sample240628-ph2f3ayglc
SHA256 e6f8559599f741c5c51425d32fe66103d669985ef697a4d3ad47066762cf3c2d
MD5 1a1832d01da648109a9e6e530c96b2d6
SHA1 ac5b176e8882e5b2e63a267dcaf2584bd2a5dee9
SHA512 cd1d30d188c9ad9d63904e460ede16a0322d244c9127518beadfa9e6547137c5eff470a47a176476ae333a790fdfcd8cd069cb6f1f3981cba49371e52300c247
SSDEEP 12288:FyHVRIMGGtpRbRi1H0xNYTpc0dbm2fABXBN4aCvvm1zq5:AVRIMGGtpxg6YG0dbm2fokkm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat bootkit persistence rat spyware

Malware Config

Extracted

Family

xtremerat

finders.hopto.org
powned.no-ip.org

Signatures

Detect XtremeRAT payload 11 IoCs

resource	yara_rule
behavioral2/memory/2104-42-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2104-40-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2292-50-0x0000000013140000-0x000000001315C000-memory.dmp	family_xtremerat
behavioral2/memory/2292-55-0x0000000013140000-0x000000001315C000-memory.dmp	family_xtremerat
behavioral2/memory/2104-54-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1132-59-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1560-62-0x0000000013140000-0x000000001315C000-memory.dmp	family_xtremerat
behavioral2/memory/1652-63-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1652-68-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1652-67-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1132-69-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{K1F3J51E-TR51-E2XK-QLN3-4JB5YC3UUWNK}	9AP0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K1F3J51E-TR51-E2XK-QLN3-4JB5YC3UUWNK}\StubPath = "C:\\InstallDir\\svhost.exe restart"	9AP0.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{XBO0HH7A-WPXC-08JH-QJ61-017GY875EEM8}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{XBO0HH7A-WPXC-08JH-QJ61-017GY875EEM8}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Google Updates\\csrss.exe restart"	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe

Executes dropped EXE 6 IoCs

pid	Process
1460	xt1006.exe
3216	9AP0.exe
4184	xt1006.exe
2104	xt1006.exe
1576	9AP0.exe
2292	9AP0.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Updates = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Google Updates\\csrss.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\InstallDir\\svhost.exe"	9AP0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\InstallDir\\svhost.exe"	9AP0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Google Updates = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Google Updates\\csrss.exe"	explorer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe
File opened for modification	\??\PhysicalDrive0	xt1006.exe
File opened for modification	\??\PhysicalDrive0	9AP0.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1616 set thread context of 2968	1616	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe	91
PID 1460 set thread context of 4184	1460	xt1006.exe	94
PID 4184 set thread context of 2104	4184	xt1006.exe	95
PID 3216 set thread context of 1576	3216	9AP0.exe	96
PID 1576 set thread context of 2292	1576	9AP0.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
608	1132	WerFault.exe	98
4900	1132	WerFault.exe	98

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1616	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe
2968	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe
1460	xt1006.exe
3216	9AP0.exe
4184	xt1006.exe
1576	9AP0.exe
1652	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 2968	1616	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe	91
PID 1616 wrote to memory of 2968	1616	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe	91
PID 1616 wrote to memory of 2968	1616	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe	91
PID 1616 wrote to memory of 2968	1616	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe	91
PID 1616 wrote to memory of 2968	1616	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe	91
PID 1616 wrote to memory of 2968	1616	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe	91
PID 1616 wrote to memory of 2968	1616	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe	91
PID 1616 wrote to memory of 2968	1616	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe	91
PID 2968 wrote to memory of 1460	2968	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe	92
PID 2968 wrote to memory of 1460	2968	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe	92
PID 2968 wrote to memory of 1460	2968	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe	92
PID 2968 wrote to memory of 3216	2968	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe	93
PID 2968 wrote to memory of 3216	2968	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe	93
PID 2968 wrote to memory of 3216	2968	1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe	93
PID 1460 wrote to memory of 4184	1460	xt1006.exe	94
PID 1460 wrote to memory of 4184	1460	xt1006.exe	94
PID 1460 wrote to memory of 4184	1460	xt1006.exe	94
PID 1460 wrote to memory of 4184	1460	xt1006.exe	94
PID 1460 wrote to memory of 4184	1460	xt1006.exe	94
PID 1460 wrote to memory of 4184	1460	xt1006.exe	94
PID 1460 wrote to memory of 4184	1460	xt1006.exe	94
PID 1460 wrote to memory of 4184	1460	xt1006.exe	94
PID 4184 wrote to memory of 2104	4184	xt1006.exe	95
PID 4184 wrote to memory of 2104	4184	xt1006.exe	95
PID 4184 wrote to memory of 2104	4184	xt1006.exe	95
PID 4184 wrote to memory of 2104	4184	xt1006.exe	95
PID 4184 wrote to memory of 2104	4184	xt1006.exe	95
PID 4184 wrote to memory of 2104	4184	xt1006.exe	95
PID 4184 wrote to memory of 2104	4184	xt1006.exe	95
PID 4184 wrote to memory of 2104	4184	xt1006.exe	95
PID 4184 wrote to memory of 2104	4184	xt1006.exe	95
PID 4184 wrote to memory of 2104	4184	xt1006.exe	95
PID 4184 wrote to memory of 2104	4184	xt1006.exe	95
PID 4184 wrote to memory of 2104	4184	xt1006.exe	95
PID 4184 wrote to memory of 2104	4184	xt1006.exe	95
PID 3216 wrote to memory of 1576	3216	9AP0.exe	96
PID 3216 wrote to memory of 1576	3216	9AP0.exe	96
PID 3216 wrote to memory of 1576	3216	9AP0.exe	96
PID 3216 wrote to memory of 1576	3216	9AP0.exe	96
PID 3216 wrote to memory of 1576	3216	9AP0.exe	96
PID 3216 wrote to memory of 1576	3216	9AP0.exe	96
PID 3216 wrote to memory of 1576	3216	9AP0.exe	96
PID 3216 wrote to memory of 1576	3216	9AP0.exe	96
PID 1576 wrote to memory of 2292	1576	9AP0.exe	97
PID 1576 wrote to memory of 2292	1576	9AP0.exe	97
PID 1576 wrote to memory of 2292	1576	9AP0.exe	97
PID 1576 wrote to memory of 2292	1576	9AP0.exe	97
PID 1576 wrote to memory of 2292	1576	9AP0.exe	97
PID 1576 wrote to memory of 2292	1576	9AP0.exe	97
PID 1576 wrote to memory of 2292	1576	9AP0.exe	97
PID 1576 wrote to memory of 2292	1576	9AP0.exe	97
PID 1576 wrote to memory of 2292	1576	9AP0.exe	97
PID 1576 wrote to memory of 2292	1576	9AP0.exe	97
PID 1576 wrote to memory of 2292	1576	9AP0.exe	97
PID 1576 wrote to memory of 2292	1576	9AP0.exe	97
PID 1576 wrote to memory of 2292	1576	9AP0.exe	97
PID 2104 wrote to memory of 1132	2104	xt1006.exe	98
PID 2104 wrote to memory of 1132	2104	xt1006.exe	98
PID 2104 wrote to memory of 1132	2104	xt1006.exe	98
PID 2104 wrote to memory of 1132	2104	xt1006.exe	98
PID 2292 wrote to memory of 1560	2292	9AP0.exe	99
PID 2292 wrote to memory of 1560	2292	9AP0.exe	99
PID 2292 wrote to memory of 1560	2292	9AP0.exe	99
PID 2292 wrote to memory of 1560	2292	9AP0.exe	99

C:\Users\Admin\AppData\Local\Temp\1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Users\Admin\AppData\Local\Temp\1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1a1832d01da648109a9e6e530c96b2d6_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Users\Admin\AppData\Local\Temp\xt1006.exe
    "C:\Users\Admin\AppData\Local\Temp\xt1006.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\xt1006.exe
      "C:\Users\Admin\AppData\Local\Temp\xt1006.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\xt1006.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xt1006.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2104
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 488
        7⤵
        Program crash
        
        PID:608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 496
        7⤵
        Program crash
        
        PID:4900
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:1652
- - C:\Users\Admin\AppData\Local\Temp\9AP0.exe
    "C:\Users\Admin\AppData\Local\Temp\9AP0.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\9AP0.exe
      "C:\Users\Admin\AppData\Local\Temp\9AP0.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\9AP0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9AP0.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2292
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1132 -ip 1132
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1132 -ip 1132
1⤵
PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9AP0.exe

Path C:\Users\Admin\AppData\Local\Temp\9AP0.exe
Size 208KB
SHA256 8db1fff7678613a881f4bc51abff56104c9f651a6a06e0b7937b6baf0935d4e8
MD5 c1dcc151a1d328f4b3b3599ca8de64dd
SHA1 2c179d4ba6765f45e5ee2625da6259383bab5377
SHA512 80388f5763c679196f2654971b7498a28ba0121c3cd892ef946833452759440544132c2024a04d3ec1fcad46afdafd535dc74329609fc1c262080140fb3abb39
SSDEEP 3072:t8hLPVZBFtQa7CGORs4BePB8T8v0WDTXJxkzUF74iWWWWWWWDPMMR8B/hf+J:QLd9tM/WBC8rXJx6D
MD5 SHA1 SHA512 SSDEEP

Submit Download

xt1006.exe

Path C:\Users\Admin\AppData\Local\Temp\xt1006.exe
Size 224KB
SHA256 00245d48c1c39e91c672ce9d168f88601dc45e340e31a275cedf08efab76a3d5
MD5 70894ac90195f81b7b714406982c1b2d
SHA1 b842869c0470a9ead6e4e6336656b78c35c426cb
SHA512 856bf97490278c48cdbdc0437aee418bcd5d05a7f16ece4afe9701ec8116afdb1e01c4d1016d014958b44ccd6e24ca75532714d25b70aebe3248dc731dda463a
SSDEEP 3072:GwC0keVnYz2i00RSD2XGm9JtC6reeESP0pP9xmRhHeC6fvgFyPMMR8B/hf+J:G10xU2i03D2WmftC6CcP0p18Kf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1132-59-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/1132-69-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/1560-62-0x0000000013140000-0x000000001315C000-memory.dmp

Download

memory/1576-53-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1576-43-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1576-45-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1652-68-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/1652-63-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/1652-67-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2104-56-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2104-54-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2104-40-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2104-42-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2292-50-0x0000000013140000-0x000000001315C000-memory.dmp

Download

memory/2292-55-0x0000000013140000-0x000000001315C000-memory.dmp

Download

memory/2968-2-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2968-70-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2968-4-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4184-37-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4184-46-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4184-33-0x0000000000400000-0x000000000041D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads