xtremerat | a57acde21e395c05b5714728c804d8501edc5a3f5c10f40f62c78d06a5c34f06

General

Target
2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe
Size 107KB
Sample240709-e2jp9awcrr
SHA256 a57acde21e395c05b5714728c804d8501edc5a3f5c10f40f62c78d06a5c34f06
MD5 2efd838e2c90b4db158e000b8532ee8e
SHA1 9ca5eec87a06e42614a6d4ed15f2c46481b30715
SHA512 f56a6b2788a65a33ff8e08e9a5fcf162a28cf69b951c488ada3822d1fa1e42a879c04e9acde59364a8e06936a853fdf536a313d941a63577f907b406a06f6bf3
SSDEEP 3072:5BvwcuzIHw1BX2r62wwU69oZyfXRGCYWwK4Qti:5BIc2XIwwBWZiXwC7wKP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4080-24-0x0000000000C80000-0x0000000000CAB000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4380	Server.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4080-0-0x0000000000C80000-0x0000000000CAB000-memory.dmp	upx
behavioral2/files/0x00070000000235f7-18.dat	upx
behavioral2/memory/4380-22-0x0000000000C80000-0x0000000000CAB000-memory.dmp	upx
behavioral2/memory/4080-24-0x0000000000C80000-0x0000000000CAB000-memory.dmp	upx
behavioral2/memory/4380-37-0x0000000000C80000-0x0000000000CAB000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe
File created	C:\Windows\InstallDir\Server.exe	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 1480	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	91
PID 4080 wrote to memory of 1480	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	91
PID 4080 wrote to memory of 1480	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	91
PID 4080 wrote to memory of 844	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	93
PID 4080 wrote to memory of 844	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	93
PID 4080 wrote to memory of 844	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	93
PID 4080 wrote to memory of 4580	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	94
PID 4080 wrote to memory of 4580	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	94
PID 4080 wrote to memory of 4580	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	94
PID 4080 wrote to memory of 2324	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	95
PID 4080 wrote to memory of 2324	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	95
PID 4080 wrote to memory of 2324	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	95
PID 4080 wrote to memory of 1808	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	96
PID 4080 wrote to memory of 1808	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	96
PID 4080 wrote to memory of 1808	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	96
PID 4080 wrote to memory of 2656	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	97
PID 4080 wrote to memory of 2656	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	97
PID 4080 wrote to memory of 2656	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	97
PID 4080 wrote to memory of 2704	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	98
PID 4080 wrote to memory of 2704	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	98
PID 4080 wrote to memory of 2704	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	98
PID 4080 wrote to memory of 1664	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	99
PID 4080 wrote to memory of 1664	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	99
PID 4080 wrote to memory of 4380	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	100
PID 4080 wrote to memory of 4380	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	100
PID 4080 wrote to memory of 4380	4080	2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe	100

C:\Users\Admin\AppData\Local\Temp\2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2efd838e2c90b4db158e000b8532ee8e_JaffaCakes118.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1664
- C:\Windows\InstallDir\Server.exe
  "C:\Windows\InstallDir\Server.exe"
  2⤵
  - Executes dropped EXE
  PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4356,i,3027467512973953085,11878940668304988630,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:8
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PCGWIN32.LI5

Path C:\ProgramData\jI82l\PCGWIN32.LI5
Size 2KB
SHA256 56901eb4f4b1f980ff2f963443c4eb7ca63d0fffef270d068adfa9a4abaee09c
MD5 91b9bf06abbc7a381bcaf9e10dfb0041
SHA1 de1ab087b22c86fd1a6a4d5bd910a9b456866651
SHA512 d1491d137b210012096851ebd655bccd40f8bff903ce38e3c1050e8440fd4d54a7938eaab6e172ce3c12707101ee9643522dcf34bf04deda476098efdc281ad9
MD5 SHA1 SHA512

Submit Download

PCGWIN32.LI5

Path C:\ProgramData\jI82l\PCGWIN32.LI5
Size 2KB
SHA256 291effe74ad092dab2d50c88bde6789c7ab6f6fa161488297c50ad3a5955b9b4
MD5 72a2b48eb20a4e512702234aa1e3adb9
SHA1 7a00c266ed420b3aece8cb33b1ba1766a97b8cda
SHA512 90bc774fccbb7d33b5e2fe4f468e46556360f3afed71c093b31116d6fb1e6e0f180275e86a3ca01abb724f729fdd78c6d8208b72e7caedc0be32a07801bb6f8f
MD5 SHA1 SHA512

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 107KB
SHA256 a57acde21e395c05b5714728c804d8501edc5a3f5c10f40f62c78d06a5c34f06
MD5 2efd838e2c90b4db158e000b8532ee8e
SHA1 9ca5eec87a06e42614a6d4ed15f2c46481b30715
SHA512 f56a6b2788a65a33ff8e08e9a5fcf162a28cf69b951c488ada3822d1fa1e42a879c04e9acde59364a8e06936a853fdf536a313d941a63577f907b406a06f6bf3
SSDEEP 3072:5BvwcuzIHw1BX2r62wwU69oZyfXRGCYWwK4Qti:5BIc2XIwwBWZiXwC7wKP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4080-0-0x0000000000C80000-0x0000000000CAB000-memory.dmp

Download

memory/4080-24-0x0000000000C80000-0x0000000000CAB000-memory.dmp

Download

memory/4380-22-0x0000000000C80000-0x0000000000CAB000-memory.dmp

Download

memory/4380-37-0x0000000000C80000-0x0000000000CAB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads