xtremerat | f63a65d08f987c8a9fc02ffd085d26c82debe5afad86b01dba2cacf1d2c2021d

General

Target
23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe
Size 176KB
Sample240703-xvq5vsvgpc
SHA256 f63a65d08f987c8a9fc02ffd085d26c82debe5afad86b01dba2cacf1d2c2021d
MD5 23723fc25a6d3e0c9a29824cf5d45012
SHA1 a4cfadda33b7a959eca8dae1181d69649f1be0fa
SHA512 32277baf5b3fdc08d3eac6128cb6f0b43e0309b555b5f68c3c91b179405c75680f14ca089bfb6a83cf7ce6fe475fb13e3d1ec9d58b5a095b7df57721ee1535cc
SSDEEP 1536:9K47Lg+tnDCDe91fp3xN1WKdBQWZQCWDu:cqLzWcfp3xd35W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

C2

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/4984-6-0x0000000000C80000-0x0000000000CAC000-memory.dmp	family_xtremerat
behavioral2/memory/2564-10-0x0000000000C80000-0x0000000000CAC000-memory.dmp	family_xtremerat
behavioral2/memory/4984-11-0x0000000000C80000-0x0000000000CAC000-memory.dmp	family_xtremerat
behavioral2/memory/4984-12-0x0000000000C81000-0x0000000000CA8000-memory.dmp	family_xtremerat
behavioral2/memory/2564-14-0x0000000000C80000-0x0000000000CAC000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Active Setup

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{66X6BJ85-YIN7-8603-81KW-5S7W60M8BWU3}	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{66X6BJ85-YIN7-8603-81KW-5S7W60M8BWU3}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart"	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe

ASPack v2.12-2.42 9 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
behavioral2/memory/4984-0-0x0000000000C80000-0x0000000000CAC000-memory.dmp	aspack_v212_v242
behavioral2/memory/4984-1-0x0000000000C80000-0x0000000000CAC000-memory.dmp	aspack_v212_v242
behavioral2/memory/4984-2-0x0000000000C80000-0x0000000000CAC000-memory.dmp	aspack_v212_v242
behavioral2/memory/4984-4-0x0000000000C80000-0x0000000000CAC000-memory.dmp	aspack_v212_v242
behavioral2/memory/4984-5-0x0000000000C80000-0x0000000000CAC000-memory.dmp	aspack_v212_v242
behavioral2/memory/4984-6-0x0000000000C80000-0x0000000000CAC000-memory.dmp	aspack_v212_v242
behavioral2/memory/2564-10-0x0000000000C80000-0x0000000000CAC000-memory.dmp	aspack_v212_v242
behavioral2/memory/4984-11-0x0000000000C80000-0x0000000000CAC000-memory.dmp	aspack_v212_v242
behavioral2/memory/2564-14-0x0000000000C80000-0x0000000000CAC000-memory.dmp	aspack_v212_v242

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe"	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe"	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2564	svchost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3168	4984	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe	83
PID 4984 wrote to memory of 3168	4984	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe	83
PID 4984 wrote to memory of 3168	4984	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe	83
PID 4984 wrote to memory of 3596	4984	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe	84
PID 4984 wrote to memory of 3596	4984	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe	84
PID 4984 wrote to memory of 3596	4984	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe	84
PID 4984 wrote to memory of 2564	4984	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe	85
PID 4984 wrote to memory of 2564	4984	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe	85
PID 4984 wrote to memory of 2564	4984	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe	85
PID 4984 wrote to memory of 2564	4984	23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\23723fc25a6d3e0c9a29824cf5d45012_JaffaCakes118.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:3168
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:3596
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2564