xtremerat | 38612efa4e3b5ebc8f4f27addf29a09f22e396b5740d13756ade669d270566a7

General

Target
28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe
Size 241KB
Sample240706-ry6f3atcqd
SHA256 38612efa4e3b5ebc8f4f27addf29a09f22e396b5740d13756ade669d270566a7
MD5 28826c6108cf11ed6788c7da2c1b45c8
SHA1 deafc8e402fd077d2eccb3227d047ce963bf9fc6
SHA512 852bfb3acf9df99281ee382942c6efa9a6683dfc856ef724d7add93d31451c3da1f71ef983037d9cc061b50ae6ecb517b75b03a14e90e2ea943ebb0962ef897d
SSDEEP 6144:0wD02+t2pubXVI6x6DiAdraBCDoAc769/c:0y0r6KXVI64HraByc769k
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

C2

eoeox.no-ip.biz

Signatures

Detect XtremeRAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/2224-27-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2224-28-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2224-29-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2224-30-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/3036-31-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2224-32-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/3036-33-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\c:\autorun.inf	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe
File opened for modification	\??\d:\autorun.inf	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe
File opened for modification	\??\e:\autorun.inf	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe
File opened for modification	\??\f:\autorun.inf	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe
File opened for modification	\??\g:\autorun.inf	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\helpnotepad.exe	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\helpnotepad.exe	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1900 set thread context of 2224	1900	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	86

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\iexplore.exe	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe
File opened for modification	C:\Program Files\iexplore.exe	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\n0tepad.exe	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe
File created	C:\WINDOWS\helpnotepad.exe	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\helpnotepad.exe	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe
File created	C:\WINDOWS\n0tepad.exe	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2980	3036	WerFault.exe	88
220	3036	WerFault.exe	88

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1900	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2224	1900	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	86
PID 1900 wrote to memory of 2224	1900	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	86
PID 1900 wrote to memory of 2224	1900	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	86
PID 1900 wrote to memory of 2224	1900	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	86
PID 1900 wrote to memory of 2224	1900	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	86
PID 1900 wrote to memory of 2224	1900	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	86
PID 1900 wrote to memory of 2224	1900	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	86
PID 1900 wrote to memory of 2224	1900	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	86
PID 1900 wrote to memory of 2224	1900	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	86
PID 1900 wrote to memory of 2224	1900	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	86
PID 1900 wrote to memory of 2224	1900	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	86
PID 1900 wrote to memory of 2224	1900	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	86
PID 1900 wrote to memory of 2224	1900	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	86
PID 2224 wrote to memory of 3036	2224	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	88
PID 2224 wrote to memory of 3036	2224	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	88
PID 2224 wrote to memory of 3036	2224	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	88
PID 2224 wrote to memory of 3036	2224	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	88
PID 2224 wrote to memory of 2268	2224	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	89
PID 2224 wrote to memory of 2268	2224	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	89
PID 2224 wrote to memory of 2268	2224	28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe"
1⤵
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\28826c6108cf11ed6788c7da2c1b45c8_JaffaCakes118.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 480
      4⤵
      Program crash
      PID:2980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 504
      4⤵
      Program crash
      PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3036 -ip 3036
1⤵
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3036 -ip 3036
1⤵
PID:3472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apphelp.exe

Path F:\apphelp.exe
Size 241KB
SHA256 38612efa4e3b5ebc8f4f27addf29a09f22e396b5740d13756ade669d270566a7
MD5 28826c6108cf11ed6788c7da2c1b45c8
SHA1 deafc8e402fd077d2eccb3227d047ce963bf9fc6
SHA512 852bfb3acf9df99281ee382942c6efa9a6683dfc856ef724d7add93d31451c3da1f71ef983037d9cc061b50ae6ecb517b75b03a14e90e2ea943ebb0962ef897d
SSDEEP 6144:0wD02+t2pubXVI6x6DiAdraBCDoAc769/c:0y0r6KXVI64HraByc769k
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1900-34-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/2224-27-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2224-28-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2224-29-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2224-30-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2224-32-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/3036-31-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/3036-33-0x0000000010000000-0x000000001004A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads