xtremerat | 47843defc39a42dd46790560e08231abe6a3df727cb5015ac670397bccf0b0aa

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 09:52

Target
38a3d2276c1c294107141da3b789288c_JaffaCakes118.exe
Size 65KB
Sample240711-lwg3sstepc
SHA256 47843defc39a42dd46790560e08231abe6a3df727cb5015ac670397bccf0b0aa
MD5 38a3d2276c1c294107141da3b789288c
SHA1 bbe7be95bd99332aa2affdb7c50b20d81bd19453
SHA512 8ca3149b653d216a6a8f12c9941c89f5c9b1c1a47e4ea9fe1ec2addfade1623f7f93562fa5db1b3062a219c00156790493f8ed0e4bc899933cd595e7232c73a9
SSDEEP 768:84m1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnco/yyR+P2ujfLiJKlA+7Xom:Wsq+QV4rObAdXWpfJyjLuzNwirNC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/2716-0-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5036	2716	WerFault.exe	82
2588	2716	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\38a3d2276c1c294107141da3b789288c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\38a3d2276c1c294107141da3b789288c_JaffaCakes118.exe"
1⤵
PID:2716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 496
  2⤵
  - Program crash
  PID:5036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 540
  2⤵
  - Program crash
  PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2716 -ip 2716
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2716 -ip 2716
1⤵
PID:2320

memory/2716-0-0x0000000010000000-0x000000001004A000-memory.dmp

Download