xtremerat | 1e0daf8b0c19aee73ce639deb625fa55e71eba2e0d472391d3f51e8d8b23a806

Analysis

max time kernel
93s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe
Size 70KB
Sample240707-3l24natgnc
SHA256 1e0daf8b0c19aee73ce639deb625fa55e71eba2e0d472391d3f51e8d8b23a806
MD5 2a314ff8bd77bc18640cecf3cedf49d9
SHA1 7f87ef6f7f5158ca058f9c55051a62ccb82e4604
SHA512 023f56a5e6f6b4f1ac5afabf8aa184b126c59ea6fd1dec038ad70fb5cc7d02c3cb2c055d95b21cd090a110e2556b5aa951febb10cde72fc1a422045bd05fab8d
SSDEEP 1536:rUqtnDVigR0Y0u3GrY7/L7gNCNFIP/SdqABz5V7WlouACjoN8E9c:pDViQH0yXg8N2P/SsAF5oKuAom8E9c
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/1064-0-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral2/memory/1064-6-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral2/memory/1064-5-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral2/memory/1064-3-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral2/memory/1064-1-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2920 set thread context of 1064	2920	2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	1064	WerFault.exe	84

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1064	2920	2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe	84
PID 2920 wrote to memory of 1064	2920	2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe	84
PID 2920 wrote to memory of 1064	2920	2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe	84
PID 2920 wrote to memory of 1064	2920	2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe	84
PID 2920 wrote to memory of 1064	2920	2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe	84
PID 2920 wrote to memory of 1064	2920	2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe	84
PID 2920 wrote to memory of 1064	2920	2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe	84
PID 2920 wrote to memory of 1064	2920	2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe	84
PID 2920 wrote to memory of 1064	2920	2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe	84
PID 2920 wrote to memory of 1064	2920	2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe	84
PID 2920 wrote to memory of 1064	2920	2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe	84
PID 2920 wrote to memory of 1064	2920	2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe	84
PID 2920 wrote to memory of 1064	2920	2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Users\Admin\AppData\Local\Temp\2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\2a314ff8bd77bc18640cecf3cedf49d9_JaffaCakes118.exe
  2⤵
  PID:1064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 12
    3⤵
    - Program crash
    PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1064 -ip 1064
1⤵
PID:5016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-0-0x0000000000C80000-0x0000000000C92000-memory.dmp

Download

memory/1064-6-0x0000000000C80000-0x0000000000C92000-memory.dmp

Download

memory/1064-5-0x0000000000C80000-0x0000000000C92000-memory.dmp

Download

memory/1064-3-0x0000000000C80000-0x0000000000C92000-memory.dmp

Download

memory/1064-1-0x0000000000C80000-0x0000000000C92000-memory.dmp

Download

memory/2920-8-0x0000000000400000-0x0000000000419000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads