xtremerat | 0cea5253c01e07ee4865548a5f3f71a4e98619e5728b873722724e085b3614b9

General

Target
20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe
Size 688KB
Sample240702-vznjesxdlr
SHA256 0cea5253c01e07ee4865548a5f3f71a4e98619e5728b873722724e085b3614b9
MD5 20320a336bf9f7e5e36a7f49b28038bb
SHA1 b6a731bd302169eab03488a8b38c7d7f90ce787e
SHA512 ef88312e9ed3e4a46a28668267235378492e2152018a84fa1c38adc3c43c89f585ad6bd898aaa6d2902a200aeb7c3c9f687ce41cd87c91a9dc6cb5f388ace790
SSDEEP 3072:aODUSwi73zjExwUxOETqaEwaFLEUYE8aUZn49MTrQD245bXD3tE875zbmbD+gJRq:aRYDFA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

C2

amhi.no-ip.info

Signatures

Detect XtremeRAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/5008-2-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/5008-4-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/5008-3-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/5008-5-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2524-6-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/5008-7-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2524-8-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5032 set thread context of 5008	5032	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2668	2524	WerFault.exe	91
1832	2524	WerFault.exe	91

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5032	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 5008	5032	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	90
PID 5032 wrote to memory of 5008	5032	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	90
PID 5032 wrote to memory of 5008	5032	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	90
PID 5032 wrote to memory of 5008	5032	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	90
PID 5032 wrote to memory of 5008	5032	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	90
PID 5032 wrote to memory of 5008	5032	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	90
PID 5032 wrote to memory of 5008	5032	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	90
PID 5032 wrote to memory of 5008	5032	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	90
PID 5032 wrote to memory of 5008	5032	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	90
PID 5032 wrote to memory of 5008	5032	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	90
PID 5032 wrote to memory of 5008	5032	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	90
PID 5032 wrote to memory of 5008	5032	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	90
PID 5032 wrote to memory of 5008	5032	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	90
PID 5008 wrote to memory of 2524	5008	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	91
PID 5008 wrote to memory of 2524	5008	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	91
PID 5008 wrote to memory of 2524	5008	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	91
PID 5008 wrote to memory of 2524	5008	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	91
PID 5008 wrote to memory of 2856	5008	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	92
PID 5008 wrote to memory of 2856	5008	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	92
PID 5008 wrote to memory of 2856	5008	20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Users\Admin\AppData\Local\Temp\20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\20320a336bf9f7e5e36a7f49b28038bb_JaffaCakes118.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2524
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 476
      4⤵
      Program crash
      PID:2668
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 504
      4⤵
      Program crash
      PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2524 -ip 2524
1⤵
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2524 -ip 2524
1⤵
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4108,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
1⤵
PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-6-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2524-8-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/5008-2-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/5008-4-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/5008-3-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/5008-5-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/5008-7-0x0000000010000000-0x000000001004A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads