xtremerat | c1d92306b26caf480f50fda2ee52c2d42741917b6347114af7d5b51381bd9903

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
417e891708cb37777bd449ff8f918494_JaffaCakes118.exe
Size 72KB
Sample240713-nnqfbayfnn
SHA256 c1d92306b26caf480f50fda2ee52c2d42741917b6347114af7d5b51381bd9903
MD5 417e891708cb37777bd449ff8f918494
SHA1 75b15e35ff19d10073befa58e2d6e73636ff364f
SHA512 a63249368dfe0576d51d0f110ee9e76e6f3873845d616eb1af9e90b44962faa62bc02e0c6ca0021bba7c555414a956f548fb90014d0adc5a96c727dba3349781
SSDEEP 1536:3S36wxWv4IoyhR/DZHuFvxoNrAal6JcboeNCJVr1V0NeAjp772nQTY:CPxWvh5P/DZH+v8A6y0NeAN77OQTY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/2352-7-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2352-6-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2352-5-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2352-3-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2352-1-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2352-0-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5072 set thread context of 2352	5072	417e891708cb37777bd449ff8f918494_JaffaCakes118.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
924	2352	WerFault.exe	83

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 2352	5072	417e891708cb37777bd449ff8f918494_JaffaCakes118.exe	83
PID 5072 wrote to memory of 2352	5072	417e891708cb37777bd449ff8f918494_JaffaCakes118.exe	83
PID 5072 wrote to memory of 2352	5072	417e891708cb37777bd449ff8f918494_JaffaCakes118.exe	83
PID 5072 wrote to memory of 2352	5072	417e891708cb37777bd449ff8f918494_JaffaCakes118.exe	83
PID 5072 wrote to memory of 2352	5072	417e891708cb37777bd449ff8f918494_JaffaCakes118.exe	83
PID 5072 wrote to memory of 2352	5072	417e891708cb37777bd449ff8f918494_JaffaCakes118.exe	83
PID 5072 wrote to memory of 2352	5072	417e891708cb37777bd449ff8f918494_JaffaCakes118.exe	83
PID 5072 wrote to memory of 2352	5072	417e891708cb37777bd449ff8f918494_JaffaCakes118.exe	83
PID 5072 wrote to memory of 2352	5072	417e891708cb37777bd449ff8f918494_JaffaCakes118.exe	83
PID 5072 wrote to memory of 2352	5072	417e891708cb37777bd449ff8f918494_JaffaCakes118.exe	83
PID 5072 wrote to memory of 2352	5072	417e891708cb37777bd449ff8f918494_JaffaCakes118.exe	83
PID 5072 wrote to memory of 2352	5072	417e891708cb37777bd449ff8f918494_JaffaCakes118.exe	83
PID 5072 wrote to memory of 2352	5072	417e891708cb37777bd449ff8f918494_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\417e891708cb37777bd449ff8f918494_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\417e891708cb37777bd449ff8f918494_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\417e891708cb37777bd449ff8f918494_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\417e891708cb37777bd449ff8f918494_JaffaCakes118.exe
  2⤵
  PID:2352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 12
    3⤵
    - Program crash
    PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2352 -ip 2352
1⤵
PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-7-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

memory/2352-6-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

memory/2352-5-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

memory/2352-3-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

memory/2352-1-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

memory/2352-0-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

memory/5072-9-0x0000000000400000-0x0000000000419000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads