xtremerat | 2f4d1c9096c9dc91f2b7ecdf238776148cfdaecc75c5ae3b5ee251d1d06ff23c

Analysis

max time kernel
95s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 04:14

Target

482d7feec23342dffb94009e980435d0_JaffaCakes118.exe
Size

106KB
MD5

482d7feec23342dffb94009e980435d0
SHA1

f3efc41bfc1f28b8a62c32959a59c88a939ba18d
SHA256

2f4d1c9096c9dc91f2b7ecdf238776148cfdaecc75c5ae3b5ee251d1d06ff23c
SHA512

2877742ea88c25a2abc263dfc3ed121b5626e5e2b517f4c88b965c8412070ab2e5e88832365fe29c6cacc4d740872e9728ffe24ee2f909bd9286ca9f1f2af79f
SSDEEP

1536:Ds6LA97tnPEjGsiHNVTqSrA060+tNJ4jtnWQHRnQxaMJnrAlwMNE9t:IhsiHNVGSF60+tNSWQHGcMJnrAlpNMt

Score

10^/10

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4060-1-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5048 set thread context of 4060	5048	482d7feec23342dffb94009e980435d0_JaffaCakes118.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1192	4060	WerFault.exe	86

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4060	5048	482d7feec23342dffb94009e980435d0_JaffaCakes118.exe	86
PID 5048 wrote to memory of 4060	5048	482d7feec23342dffb94009e980435d0_JaffaCakes118.exe	86
PID 5048 wrote to memory of 4060	5048	482d7feec23342dffb94009e980435d0_JaffaCakes118.exe	86
PID 5048 wrote to memory of 4060	5048	482d7feec23342dffb94009e980435d0_JaffaCakes118.exe	86
PID 5048 wrote to memory of 4060	5048	482d7feec23342dffb94009e980435d0_JaffaCakes118.exe	86
PID 5048 wrote to memory of 4060	5048	482d7feec23342dffb94009e980435d0_JaffaCakes118.exe	86
PID 5048 wrote to memory of 4060	5048	482d7feec23342dffb94009e980435d0_JaffaCakes118.exe	86
PID 5048 wrote to memory of 4060	5048	482d7feec23342dffb94009e980435d0_JaffaCakes118.exe	86
PID 5048 wrote to memory of 4060	5048	482d7feec23342dffb94009e980435d0_JaffaCakes118.exe	86
PID 5048 wrote to memory of 4060	5048	482d7feec23342dffb94009e980435d0_JaffaCakes118.exe	86
PID 5048 wrote to memory of 4060	5048	482d7feec23342dffb94009e980435d0_JaffaCakes118.exe	86
PID 5048 wrote to memory of 4060	5048	482d7feec23342dffb94009e980435d0_JaffaCakes118.exe	86
PID 5048 wrote to memory of 4060	5048	482d7feec23342dffb94009e980435d0_JaffaCakes118.exe	86

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4060 -ip 4060
1⤵
PID:3436

memory/4060-1-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5048-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/5048-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download