xtremerat | 3682a8db3d0547f310e90553aa4dd8b47f74ee0d455db1065286bda755ce0d03

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe
Size 2.4MB
Sample240703-pygrlawana
SHA256 3682a8db3d0547f310e90553aa4dd8b47f74ee0d455db1065286bda755ce0d03
MD5 226bf03ddb74f2758ca9f5a8b10a2926
SHA1 fbefc2c0634758f37063f9666f949aeccd6b4d8f
SHA512 e2d8c47f0df03a75de3b8e2d1de129dc37d02c96a35a2edc1fc81b887b9166ca921d83dc7eb9864589d279cff8dfeb342de9a48d60edfcbe8c511a2de927cd88
SSDEEP 49152:oE8bdLp54v34cn6uXoah3zKxzx7YNnni4j6MRjv9aq/Jrs+HwN57o8lXATQ:oEyVMv5BzMciw6MJzFs+HYFXw8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat evasion persistence rat spyware themida

Malware Config

Extracted

Family

xtremerat

ozanresulkayan.dyndns.biz

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/2152-6-0x0000000010000000-0x000000001024B000-memory.dmp	family_xtremerat
behavioral2/memory/2152-5-0x0000000010000000-0x000000001024B000-memory.dmp	family_xtremerat
behavioral2/memory/2152-7-0x0000000010000000-0x000000001024B000-memory.dmp	family_xtremerat
behavioral2/memory/3080-12-0x0000000010000000-0x000000001024B000-memory.dmp	family_xtremerat
behavioral2/memory/3080-24-0x0000000010000000-0x000000001024B000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4772	798WolfTeam.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine	798WolfTeam.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000700000002342c-18.dat	themida
behavioral2/memory/4772-22-0x0000000000400000-0x00000000006EB000-memory.dmp	themida
behavioral2/memory/4772-25-0x0000000000400000-0x00000000006EB000-memory.dmp	themida

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2932 set thread context of 2152	2932	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	81

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\798WolfTeam.exe.exe	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe
File created	C:\Windows\798WolfTeam.exe	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4660	3080	WerFault.exe	82
1540	3080	WerFault.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2932	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2152	2932	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	81
PID 2932 wrote to memory of 2152	2932	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	81
PID 2932 wrote to memory of 2152	2932	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	81
PID 2932 wrote to memory of 2152	2932	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	81
PID 2932 wrote to memory of 2152	2932	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	81
PID 2932 wrote to memory of 2152	2932	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	81
PID 2932 wrote to memory of 2152	2932	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	81
PID 2932 wrote to memory of 2152	2932	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	81
PID 2932 wrote to memory of 2152	2932	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	81
PID 2932 wrote to memory of 2152	2932	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	81
PID 2932 wrote to memory of 2152	2932	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	81
PID 2932 wrote to memory of 2152	2932	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	81
PID 2932 wrote to memory of 2152	2932	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	81
PID 2152 wrote to memory of 3080	2152	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	82
PID 2152 wrote to memory of 3080	2152	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	82
PID 2152 wrote to memory of 3080	2152	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	82
PID 2152 wrote to memory of 3080	2152	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	82
PID 2152 wrote to memory of 3124	2152	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	83
PID 2152 wrote to memory of 3124	2152	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	83
PID 2152 wrote to memory of 3124	2152	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	83
PID 2152 wrote to memory of 4772	2152	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	86
PID 2152 wrote to memory of 4772	2152	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	86
PID 2152 wrote to memory of 4772	2152	226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\226bf03ddb74f2758ca9f5a8b10a2926_JaffaCakes118.exe
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 484
      4⤵
      Program crash
      PID:4660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 492
      4⤵
      Program crash
      PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3124
- - C:\Windows\798WolfTeam.exe
    "C:\Windows\798WolfTeam.exe"
    3⤵
    - Executes dropped EXE
    - Identifies Wine through registry keys
    PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3080 -ip 3080
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3080 -ip 3080
1⤵
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

798WolfTeam.exe

Path C:\Windows\798WolfTeam.exe
Size 2.0MB
SHA256 a3ec6bf01b6a06f3aa032c98c0f1a99764f90fc191cd85f04e9d05e52e03c1d3
MD5 4b9a46075c66b15f078ba266aa8a8ade
SHA1 db4363b43a45bf11c8936c05a200c725b9f336c7
SHA512 8a1a9ca0dba770339c98790f82e1fb2771b0dea591e5dfef9da187935e0d3d795005d502458082c7a5731020bbecd09539490c3f98f42bbcb5871415f4654041
SSDEEP 24576:Z8jqXDClr1dFpAd8sVPdHcdzBCAvi7DriyVQBAFrW+c6g5ARHx4yWCz/uUbD4MyI:SjqXDUnFVs5Q9qVQBA1ch8qyWC/blSk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2152-7-0x0000000010000000-0x000000001024B000-memory.dmp

Download

memory/2152-6-0x0000000010000000-0x000000001024B000-memory.dmp

Download

memory/2152-5-0x0000000010000000-0x000000001024B000-memory.dmp

Download

memory/2152-8-0x0000000000400000-0x000000000055D000-memory.dmp

Download

memory/2932-4-0x0000000000401000-0x0000000000421000-memory.dmp

Download

memory/2932-0-0x0000000000400000-0x000000000055D000-memory.dmp

Download

memory/2932-11-0x0000000000401000-0x0000000000421000-memory.dmp

Download

memory/2932-10-0x0000000000400000-0x000000000055D000-memory.dmp

Download

memory/2932-1-0x0000000000400000-0x000000000055D000-memory.dmp

Download

memory/3080-12-0x0000000010000000-0x000000001024B000-memory.dmp

Download

memory/3080-24-0x0000000010000000-0x000000001024B000-memory.dmp

Download

memory/4772-22-0x0000000000400000-0x00000000006EB000-memory.dmp

Download

memory/4772-25-0x0000000000400000-0x00000000006EB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads