xtremerat | 4a7f263d26f2d0a870def30926364f58f342af0f6257164f8fbdb5dd349a5c6d

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 18:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe
Size 89KB
Sample240708-wnmnestfnf
SHA256 4a7f263d26f2d0a870def30926364f58f342af0f6257164f8fbdb5dd349a5c6d
MD5 2d501b76fdd2e56147ff303539e82c51
SHA1 593696c40444abd257c1e4c5f50c384b84f4d4e9
SHA512 695e23728db62e57cf9fbc270f08368536908b25637ae652aaf71d079fb7e55805d23f285e6dce86e4b336363f039683899499614e0958fa225cb6816c32e3d1
SSDEEP 1536:vnG+oHD7n7xkFDmTB18YpsiIXC+mGmWxj68/MqQJF640bW90Pk9xkjK89Sz3eZ:/G7B5PYC+mGmWvdQ640bW9BjOK89SzOZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/988-4-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/988-5-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/988-7-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/988-8-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/988-9-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4820 set thread context of 988	4820	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	82

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftWareProtector\Project1_out.pr	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4820	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 988	4820	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	82
PID 4820 wrote to memory of 988	4820	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	82
PID 4820 wrote to memory of 988	4820	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	82
PID 4820 wrote to memory of 988	4820	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	82
PID 4820 wrote to memory of 988	4820	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	82
PID 4820 wrote to memory of 988	4820	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	82
PID 4820 wrote to memory of 988	4820	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	82
PID 4820 wrote to memory of 988	4820	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	82
PID 4820 wrote to memory of 988	4820	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	82
PID 4820 wrote to memory of 988	4820	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	82
PID 4820 wrote to memory of 988	4820	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	82
PID 4820 wrote to memory of 988	4820	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	82
PID 4820 wrote to memory of 988	4820	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	82
PID 988 wrote to memory of 4108	988	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	84
PID 988 wrote to memory of 4108	988	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	84
PID 988 wrote to memory of 4108	988	2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\2d501b76fdd2e56147ff303539e82c51_JaffaCakes118.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/988-4-0x0000000010000000-0x0000000010047000-memory.dmp

Download

memory/988-5-0x0000000010000000-0x0000000010047000-memory.dmp

Download

memory/988-7-0x0000000010000000-0x0000000010047000-memory.dmp

Download

memory/988-8-0x0000000010000000-0x0000000010047000-memory.dmp

Download

memory/988-9-0x0000000010000000-0x0000000010047000-memory.dmp

Download

memory/4820-0-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4820-6-0x0000000000400000-0x000000000045D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads