xtremerat | 6da67635f97ae7851d174785a537bb652cdd81df909c6e5a65047313c16b25f4

General

Target
27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe
Size 68KB
Sample240706-jelnjstbne
SHA256 6da67635f97ae7851d174785a537bb652cdd81df909c6e5a65047313c16b25f4
MD5 27bea8d5dc7096ba6bc3e64eb8c0538b
SHA1 d30a8dba846837f4264ac3727272991df1341e08
SHA512 0361158cc4c749aa7d3a04b7132d97bd6ba9e7ad86dc7f253f0cd01d1e933495e68dbd9494585d0b27c2f1e8545dd4fd3183fd40dd955ec85cdf013889d1400b
SSDEEP 768:1XxOS44sR2L2Xd24dW/rvMQMNh4Mmv71rHWd8fif2QnAiF5e41u1tcoOVVRVcs:RP7LRKwbMFNev7tBqfTHDKtcoAVcs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

C2

ogdd.servemp3.com

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/3452-5-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/3452-6-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/3896-7-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/3452-8-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/3896-9-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3452-2-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3452-4-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3452-5-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3452-6-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3896-7-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3452-8-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3896-9-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1128 set thread context of 3452	1128	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3668	3896	WerFault.exe	85
3252	3896	WerFault.exe	85

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1128	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 3452	1128	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	83
PID 1128 wrote to memory of 3452	1128	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	83
PID 1128 wrote to memory of 3452	1128	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	83
PID 1128 wrote to memory of 3452	1128	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	83
PID 1128 wrote to memory of 3452	1128	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	83
PID 1128 wrote to memory of 3452	1128	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	83
PID 1128 wrote to memory of 3452	1128	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	83
PID 1128 wrote to memory of 3452	1128	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	83
PID 3452 wrote to memory of 3896	3452	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	85
PID 3452 wrote to memory of 3896	3452	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	85
PID 3452 wrote to memory of 3896	3452	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	85
PID 3452 wrote to memory of 3896	3452	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	85
PID 3452 wrote to memory of 3824	3452	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	87
PID 3452 wrote to memory of 3824	3452	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	87
PID 3452 wrote to memory of 3824	3452	27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Local\Temp\27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\27bea8d5dc7096ba6bc3e64eb8c0538b_JaffaCakes118.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 484
      4⤵
      Program crash
      PID:3668
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 492
      4⤵
      Program crash
      PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3896 -ip 3896
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3896 -ip 3896
1⤵
PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3452-2-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3452-4-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3452-5-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3452-6-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3452-8-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3896-7-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3896-9-0x0000000010000000-0x000000001004D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads