xtremerat | cbcf35031f3e4150de9a506e870dc6f4f33163407c36ff6ec30b3c1c6a8d6b77

Analysis

max time kernel
139s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe
Size 418KB
Sample240712-ay2pfatdrg
SHA256 cbcf35031f3e4150de9a506e870dc6f4f33163407c36ff6ec30b3c1c6a8d6b77
MD5 3b584abc4a9e9d797ed0301d87cf19f2
SHA1 f245929f67cbe3d6dc529a8738576b7bf30900ec
SHA512 c2b94fc3d5e53537520a85ab6af4bfe0cca5a20d30bf62ba682dc48aac737929485a5002a4f9cfc5674d4aa0092db3e18d5556038ca190d67c44d74deb13a598
SSDEEP 12288:857qSYh+Tu1lxHxCgpcAnirLS9Mm5dmXHw9:I7jYhcExN0i9MsdYQ9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

ketchup.no-ip.biz

Signatures

Detect XtremeRAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/1668-53-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/624-55-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/624-56-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1668-48-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/1668-50-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/1668-53-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/624-55-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/624-56-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2188 set thread context of 1668	2188	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2524	624	WerFault.exe	85
3288	624	WerFault.exe	85

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BFP8GTV1HBABGTVL64MF9MC9TJMJFSVF7VBCVPJGV	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe
File created	C:\ProgramData\DYA_PPHDTFHSLSSKOHJCD\1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BFP8GTV1HBABGTVL64MF9MC9TJMJFSVF7VBCVPJGV	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe
File created	C:\Users\Public\Desktop:$SS_DESCRIPTOR_SBXNV9VVGV1BFP8GTV1HBABGTVL64MF9MC9TJMJFSVF7VBCVPJGV	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2188	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1668	2188	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	84
PID 2188 wrote to memory of 1668	2188	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	84
PID 2188 wrote to memory of 1668	2188	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	84
PID 2188 wrote to memory of 1668	2188	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	84
PID 2188 wrote to memory of 1668	2188	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	84
PID 2188 wrote to memory of 1668	2188	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	84
PID 2188 wrote to memory of 1668	2188	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	84
PID 2188 wrote to memory of 1668	2188	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	84
PID 1668 wrote to memory of 624	1668	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	85
PID 1668 wrote to memory of 624	1668	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	85
PID 1668 wrote to memory of 624	1668	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	85
PID 1668 wrote to memory of 624	1668	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	85
PID 1668 wrote to memory of 1732	1668	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	87
PID 1668 wrote to memory of 1732	1668	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	87
PID 1668 wrote to memory of 1732	1668	3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Local\Temp\3b584abc4a9e9d797ed0301d87cf19f2_JaffaCakes118.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 480
      4⤵
      Program crash
      PID:2524
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 488
      4⤵
      Program crash
      PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 624 -ip 624
1⤵
PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 624 -ip 624
1⤵
PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.dat

Path C:\ProgramData\DYA_PPHDTFHSLSSKOHJCD\1.0.0\Data\app.dat
Size 971B
SHA256 1faafa2110991dc9f083b064dd22a431ff4f606780ded14ac3c49e0f45261ff0
MD5 775e67041e9d59e51ff8ea342ba98614
SHA1 a51bdc498437c09a5ddc5aecf050fd13adfe611d
SHA512 25f8e2e4ea977b7400e440dcf885ce757a6f8d17275d67609e11d2c2beda0e271e16a0abbaf0f7e229719b929b87e92c846eea25a9af35918bbcf2a5c02a338d
MD5 SHA1 SHA512

Submit Download

updates.dat

Path C:\ProgramData\DYA_PPHDTFHSLSSKOHJCD\1.0.0\Data\updates.dat
Size 971B
SHA256 6ca355b0baa4dacff373136eea5102a4fcfad695f3bebefcce513a0d954fe82b
MD5 96a576db2ba32fd36e7038f3d19c70db
SHA1 6c5258276b110f64fa5046ede0944c2d89f6b471
SHA512 62f2c1a0e1ad5621cd0bb7e0b8042749e0431fa5b9cdb6b24b45845dcc07dbe7d9b9dca3650c11ea6bf56def9410a990277da50ab47f2e42947788b6a564d391
MD5 SHA1 SHA512

Submit Download

dya.dat

Path C:\Users\Admin\AppData\Roaming\DYA_PPHDTFHSLSSKOHJCD\1.0.0\Data\dya.dat
Size 971B
SHA256 c904d60760fc838098ec7075b925b8907bd543bdbc1c440342189469251a2892
MD5 74ea5becdb5f3fc5522244b2fb1e4fa7
SHA1 aece491d576e7da7eba2dd26a995374200cefd75
SHA512 0a3e10db4230ca1a964157458a196394a3b40eb5089e9c326d7c8da38fb3ceae1b98215c4be56d307f12ad25481ee8d62a095c11d2af429ad04ce6b60d278b67
MD5 SHA1 SHA512

Submit Download

memory/624-55-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/624-56-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/1668-50-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/1668-48-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/1668-53-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/2188-43-0x0000000000400000-0x00000000004A8BF4-memory.dmp

Download

memory/2188-46-0x0000000000400000-0x00000000004A8BF4-memory.dmp

Download

memory/2188-0-0x0000000000400000-0x00000000004A8BF4-memory.dmp

Download

memory/2188-54-0x0000000000407000-0x00000000004A4000-memory.dmp

Download

memory/2188-51-0x0000000000400000-0x00000000004A8BF4-memory.dmp

Download

memory/2188-44-0x0000000000400000-0x00000000004A8BF4-memory.dmp

Download

memory/2188-1-0x0000000000407000-0x00000000004A4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads